Route Pinned Jurisdiction to Its Own Cell · Entire

Summary

PR #1619 is actually about entire auth token (unhiding it + adding --jurisdiction). You wanted the analogous treatment for entire api. Here's what I found and did:

What was already true

• entire api is already visible in both entire help and entire agent-help (it has no Hidden: true), and agent-help renders live from the Cobra tree, so it already showed up in the "when to use entire" map and drill-down. No visibility change was needed.

What I changed (cmd/entire/cli/api_cmd.go)

1. Added --jurisdiction <slug> — reaches a specific jurisdiction's entire-api cell (e.g. us, eu) instead of your home cell. It reuses the existing, audited cell machinery: it passes auth.CellTarget{Jurisdiction: slug} into NewEntireAPICellClient, which mints the RFC-8693 identity token for that jurisdiction and resolves that jurisdiction's cell URL from the cluster catalog. No new exchange/URL/security logic.
2. Ergonomic --to interplay (resolveAPITarget): --jurisdiction implies --to cell; combining it with an explicit --to core is a contradiction and errors clearly. The slug is normalized to a bare lowercase label (US/" us " → us); NewEntireAPICellClient validates it as a DNS label.
3. Surfaced/explained it for agents — updated the command's Long and Example (which feed entire agent-help api live) and the --jurisdiction flag usage string, so agents drilling in see how to use it.
4. Introduced apiTargetCore/apiTargetCell constants (satisfies goconst).

Docs & tests

• CLAUDE.md: added api to the top-level command list with a paragraph explaining --to core/--to cell/--jurisdiction and that it's the supported, agent-discoverable way to call the API.
• api_cmd_test.go: added a table-driven TestResolveAPITarget (pass-through, implied-cell + slug normalization, explicit cell, contradiction) and updated resolveAPIClient's call for the new signature.

Verification

• mise run fmt + mise run lint → 0 issues
• go test ./cmd/entire/cli/ ./cmd/entire/cli/auth/ → pass
• Confirmed against the built binary: entire api --help shows the flag + examples, entire agent-help api explains it, and entire api --to core --jurisdiction eu gives the clean contradiction error.

Note: I built this on your current soph/cli-api-polish branch (not PR #1619's branch) since it's the entire api work. I did not commit — let me know if you'd like me to commit/push.

Summary of what shipped

• Created a clean branch soph/cli-api-jurisdiction off main's tip (the previous branch had no commits of its own — just working-tree changes).
• Committed the 3 files (api_cmd.go, api_cmd_test.go, CLAUDE.md), lint verified clean before push.
• Opened PR #1631 targeting main with a full description mirroring the structure of the sibling PR #1619.

The change adds --jurisdiction to entire api, wires it through the existing cell machinery, and makes it discoverable/explained in entire agent-help api.