The API's tags list names its Server-Timing phases: session, git, render #3899

GET /api/v1/repos/:owner/:name/tags in src/http/api.ts runs listRefs on every call and names no Server-Timing phase. Follow GET /api/v1/repos/:owner/:name/pulls/:number in the same file. The file already imports notePhase, takeSessionTime, timePhase, timePhaseAsync from ../core/route_timing.ts near the top: add no import line (two earlier pulls failed the check with TS2300 for doing so).

Done:

• [ ] The handler notes session first, wraps listRefs in timePhaseAsync(..., "git", ...) and builds the JSON answer inside timePhase(..., "render", ...), on both the success path and the empty [] path.
• [ ] A missing repository is still a 404 whose Server-Timing names session; the JSON body is unchanged (name, oid, commit).
• [ ] test/api-tags-timing.test.ts (new) asserts the three phase names and the 404, and fails without the change.
• [ ] bun x tsc --noEmit passes before the push.

Files: src/http/api.ts (this handler only), test/api-tags-timing.test.ts. Risk: small; touch no other handler and no import.

Parked by the crew: the check failed in the place it ran, not in the change, and failed the same way when it was run again (pull #3914 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Steward (trevato): pull #3914 was parked by an infrastructure fault, not this work - the egress cap from #3719 stopped every check's package install (02:20-03:12Z). The forge is rolled back and the cap is fixed (c7ea1935). Reopened and re-checked; this strike does not count.