feat(mirror): add repo mirror collaborators add/remove/list

[toothbrush]

https://entire.io/gh/entireio/cli/trails/600

Spinoff of #1457 (based on its branch — these commands are cross-region control-plane ops that need the cross-juris transport that PR adds).

What

Adds mirror permission management verbs to the public CLI, under the existing entire repo mirror subtree:

entire repo mirror collaborators add    <github-url> <handle> [cluster-host] --role reader|writer
entire repo mirror collaborators remove <github-url> <handle> [cluster-host]
entire repo mirror collaborators list   <github-url> [cluster-host]

Ergonomics: cluster-host is an optional trailing positional defaulting to defaultClusterHost, consistent with sibling mirror create/remove. add/list honor --json; remove prints a prose confirmation to stdout (no body to render), like the other remove/revoke commands. They hit the user-facing /mirrors/collaborators endpoints (GitHub-admin gated).

coreapi regen — needs a look

Refreshed spec/core.openapi.json from the live console and ran go generate. The spec drift is clean: only the 3 collaborator ops + an unrelated GET /version (latent, no command wired).

However, go generate with gen.go's pinned ogen@v1.20.3 re-churns oas_security_gen.go by ~76 lines (Op: {} ⟷ Op: []string{}). Root cause: ogen emits []string{}, and our committed files are gofmt -s-simplified to {} — the simplify pass (which lint:gofmt enforces via gofmt -l -s) isn't part of the go generate recipe in gen.go. Running gofmt -s -w after generate collapses it back, so the committed diff here is purely additive.

Fixed at the source in this PR: the //go:generate recipe in internal/coreapi/gen.go now ends with gofmt -s -w ., so a bare go generate is idempotent and CI-clean — the []string{} ⟷ {} churn no longer escapes the recipe.

Test

go test ./cmd/entire/cli/ ./internal/coreapi/
mise run lint

Added unit tests for parseMirrorRole, clusterArgAt, and mirrorCollaboratorRow.

---

Note

Medium Risk
Changes who can pull/push mirrored repos via live GitHub-admin-gated API calls; mistakes or misuse affect access control, though enforcement remains server-side.

Overview
Adds entire repo mirror collaborators with add, remove, and list so GitHub admins can grant or revoke per-cluster mirror access (reader / writer) for a qualified handle, with optional trailing cluster-host like other mirror commands.

Introduces clusterArgAt for commands that put the cluster after extra positionals (e.g. <handle>). parseMirrorRole and table helpers validate --role and format list output; unit tests cover those paths.

Regenerates internal/coreapi from an updated OpenAPI spec (mirror collaborator endpoints plus incidental GET /version and repo mirror-suspension fields). gen.go now runs gofmt -s -w . after ogen so generate stays lint-clean.

^{Reviewed by Cursor Bugbot for commit 94030f4. Configure here.}

[Copilot]

Pull request overview

Adds public CLI support for managing per-mirror collaborators under entire repo mirror collaborators, backed by regenerated internal/coreapi client code for the new /mirrors/collaborators endpoints (plus a newly surfaced /version endpoint in the spec).

Changes:

• Add repo mirror collaborators add|remove|list commands, including role parsing and table rendering for human output.
• Refactor cluster-host positional parsing via clusterArgAt, and add unit tests for the new helpers/row formatting.
• Regenerate internal/coreapi OpenAPI specs + ogen output to include mirror-collaborator APIs (and /version).

Reviewed changes

Copilot reviewed 4 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/coreapi/spec/core.openapi.json	Updates the OpenAPI source spec to include /mirrors/collaborators and /version.
internal/coreapi/spec/core.gen.json	Regenerated normalized spec used by codegen (new schemas + endpoints).
internal/coreapi/oas_validators_gen.go	Generated validators for new request/response models and enum types.
internal/coreapi/oas_security_gen.go	Generated security-operation maps updated for new mirror-collaborator ops.
internal/coreapi/oas_schemas_gen.go	Generated Go schema/types for collaborator and version endpoints (plus new repo fields).
internal/coreapi/oas_response_decoders_gen.go	Generated response decoders for getVersion + collaborator endpoints.
internal/coreapi/oas_request_encoders_gen.go	Generated request encoder for grantMirrorCollaborator.
internal/coreapi/oas_parameters_gen.go	Generated parameter structs for list/revoke mirror collaborators.
internal/coreapi/oas_operations_gen.go	Registers new operation names for codegen/client wiring.
internal/coreapi/oas_client_gen.go	Generated client methods for getVersion and mirror collaborator add/list/remove.
cmd/entire/cli/repo_mirror.go	Adds collaborators subtree to repo mirror, and introduces clusterArgAt.
cmd/entire/cli/repo_mirror_test.go	Adds tests for clusterArgAt, parseMirrorRole, and mirrorCollaboratorRow.
cmd/entire/cli/repo_mirror_collaborators.go	Implements `repo mirror collaborators add

Files not reviewed (9)

• internal/coreapi/oas_client_gen.go: Generated file
• internal/coreapi/oas_json_gen.go: Generated file
• internal/coreapi/oas_operations_gen.go: Generated file
• internal/coreapi/oas_parameters_gen.go: Generated file
• internal/coreapi/oas_request_encoders_gen.go: Generated file
• internal/coreapi/oas_response_decoders_gen.go: Generated file
• internal/coreapi/oas_schemas_gen.go: Generated file
• internal/coreapi/oas_security_gen.go: Generated file
• internal/coreapi/oas_validators_gen.go: Generated file

[toothbrush]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 94030f4. Configure here.}