auth-go lock dir isolation doesn't cover spawned binaries

Follow-up to #2173, which stopped auth-go's process lock landing in the developer's real user cache under go test.

That fix is in-process only. tokenManagerLockDir (cmd/entire/cli/auth/refresh.go:156) returns testdirs.Dir("authlock"), and testdirs.Dir returns ok=false in a subprocess (internal/testdirs/testdirs.go:26-29). The integration and e2e TestMains set ENTIRE_CONFIG_DIR and XDG_CACHE_HOME but not HOME, and on macOS os.UserCacheDir() ignores XDG_CACHE_HOME - so a spawned entire that reaches a token refresh still writes into the real ~/Library/Caches/auth-go.

userdirs and tokenstore each pair testdirs with an env override (ENTIRE_CONFIG_DIR, ENTIRE_TOKEN_STORE_PATH). This one implements only half that pattern.

Suggested: check an ENTIRE_AUTH_LOCK_DIR env var ahead of testdirs.Dir, and set it in the integration and e2e TestMains alongside the existing isolation vars.

Note the practical exposure is unproven - no spawned binary was observed reaching the lock before failing at the network - but the mechanism is confirmed.

Start with tokenManagerLockDir in cmd/entire/cli/auth/refresh.go and the subprocess behavior in internal/testdirs/testdirs.go. Then inspect the integration and e2e TestMains where ENTIRE_CONFIG_DIR and XDG_CACHE_HOME are set. Done means spawned binaries receive an isolated auth lock directory and token refresh no longer falls back to the developer's real cache.