cli/api: add --jurisdiction and document the command

[Soph]

What

• Add --jurisdiction <slug> (short -j) to entire api (e.g. us, eu) to target a specific jurisdiction's entire-api cell instead of the caller's home cell.
• Document entire api in CLAUDE.md, which was missing it entirely.

# home cell (unchanged)
entire api --to cell /api/v1/me/activity

# a specific jurisdiction's cell (implies --to cell)
entire api --jurisdiction eu /api/v1/me/activity
entire api -j eu /api/v1/me/activity

Why

entire api --to cell only ever reached the caller's home entire-api cell. There was no way to call a different jurisdiction's cell from the CLI, even though the underlying cell client (auth.NewEntireAPICellClient + auth.CellTarget) already supports pinning a jurisdiction. This is the sibling of PR #1619, which added --jurisdiction to entire auth token.

Details

• Reuses existing machinery, no new security logic. --jurisdiction passes auth.CellTarget{Jurisdiction: slug} into NewEntireAPICellClient, which mints the jurisdictional identity token (RFC 8693, scope=openid, aud=<jurisdiction host>) and resolves that jurisdiction's cell URL from the cluster catalog — the same audited path used elsewhere.
• --jurisdiction implies --to cell. Combining it with an explicit --to core is a contradiction and errors clearly (--jurisdiction targets a cell; use --to cell (not --to core)). The slug is normalized to a bare lowercase DNS label (US/" us " → us); NewEntireAPICellClient validates it as a label.
• -j shorthand. Added alongside the existing -X/-f/-F/-H/-i shorthands (-j was free).
• Agent discoverability. entire api was already visible in entire help and entire agent-help, and agent-help renders live from the Cobra tree — so the updated Long, Example, and flag usage explain --jurisdiction automatically on entire agent-help api drill-down. No annotation changes needed.

Testing

• New table-driven TestResolveAPITarget covers pass-through, implied-cell + slug normalization, explicit cell, and the --to core contradiction.
• mise run fmt + mise run lint clean.
• go test ./cmd/entire/cli/ ./cmd/entire/cli/auth/ passes.
• Verified against the built binary: entire api --help / entire agent-help api show the flag (-j, --jurisdiction) + examples, and entire api --to core --jurisdiction eu emits the contradiction error.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Adds first-class support for calling a specific jurisdiction’s entire-api cell from entire api, and documents the command surface so it’s discoverable via help/agent-help and CLAUDE.md.

Changes:

• Add --jurisdiction <slug> to entire api, with slug normalization and a --to core + --jurisdiction contradiction error.
• Thread the resolved jurisdiction into cell client construction via auth.CellTarget{Jurisdiction: ...}.
• Document api in CLAUDE.md alongside the other top-level commands.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
cmd/entire/cli/api_cmd.go	Adds --jurisdiction, resolves --to/--jurisdiction interplay, and passes jurisdiction into cell client creation.
cmd/entire/cli/api_cmd_test.go	Updates client tests for new signature and adds coverage for target resolution behavior.
CLAUDE.md	Documents the api command and the new --jurisdiction behavior for users/agents.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7e82009. Configure here.}