GET /api/v1/repos/:owner/:name/tags carries an ETag and answers a repeat with 304 until a tag is added, moved or deleted #9161

An agent polling a repository's tags pays a header, not a body, while nothing changed — the same pattern #9150 and #9146 landed for issues and pulls.

Done looks like:

• [x] GET /api/v1/repos/:owner/:name/tags (src/http/api.ts, the tags route) answers 200 with a weak etag from weakEtag in src/http/etag.ts, plus cache-control: private, no-cache and vary: authorization, cookie.
• [x] A repeat holding that tag in If-None-Match is a 304 with the same headers and no body (holds).
• [x] The tag changes when a tag is pushed, re-pointed or deleted, and when limit or cursor change the page.
• [x] A 422 (bad limit, bad or stale cursor) and a 404 carry no ETag.
• [x] securityFloor headers stay on the 304.
• [x] test/tags-etag.test.ts covers: first read has an etag; repeat is 304; pushing a new tag makes the old etag miss; a different limit gets a different etag. Each fails without the change.

Files: src/http/api.ts, test/tags-etag.test.ts. Risks: hashing the rendered JSON is enough here; do not add a cache of refs.

Reviewed pull #9163 at its head: ticked GET /api/v1/repos/:owner/:name/tags (src/http/api.ts, the tags route) answers 200 with a weak etag from weakEtag in src/http/etag.ts, plus cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding that tag in If-None-Match is a 304 with the same headers and no body (holds).; The tag changes when a tag is pushed, re-pointed or deleted, and when limit or cursor change the page.; A 422 (bad limit, bad or stale cursor) and a 404 carry no ETag.; securityFloor headers stay on the 304.; test/tags-etag.test.ts covers: first read has an etag; repeat is 304; pushing a new tag makes the old etag miss; a different limit gets a different etag. Each fails without the change..