feat(engine): TAG-ANNOTATED — a movable tag is a movable pin

First of the approved §5 checks. A lightweight tag is a branch-like ref:
it can be moved to another commit with nothing recorded that it ever
pointed elsewhere. The catalog pins every plugin to `ref: vX.Y.Z`, so
this is a supply-chain property, not tidiness.

The two levels come from a measurement, not from taste. Across all 19
clones: 155 tags, 14 lightweight, but only ONE repo whose NEWEST tag is
lightweight. The newest is what a consumer resolves today and what an
operator can re-cut at no cost -> ERROR. The older ones can only be
"fixed" by force-moving an already published ref, which is the exact risk
the check exists to name -> exposed once as a count, WARN, never as
fourteen findings. A gate that demands an unsafe remedy gets switched off.

No tags at all is the VERSION-NONE shape: the check ran, saw every tag
there is, and found no subject. TAGS-NONE is an OK, not a skip.

Newest is decided by version order, not by the order git returns.
`git tag --list` sorts lexically, where v10.0.0 lands before v9.0.0 —
which would misjudge exactly the repos with the longest history
(repo-mailbox has 27 tags). Pinned in test.

Read from local git objects via `for-each-ref %(objecttype)` — zero
network, so the two-call budget is untouched.

Measured on the corpus, and it matches the census exactly: 1 ERROR
(ktg-plugin-marketplace v7.7.2), 3 WARN (catalog 7, okf 5, guard 1),
15 OK, 2 TAGS-NONE. No other repo moved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lb7XmJGLnFSX9U7tgS7fKk

CLAUDE.md

@@ -158,13 +158,23 @@ would recreate, in data, exactly the drift this plugin exists to remove.
   `0.5.0`. `engineCommit` closes that, derived from the same checkout with no
   network call. It is present-and-`null` when underivable, never absent — an
   absent key means an older engine, `null` means this one ran without a HEAD.
+- **A finding must name a remedy the operator can safely perform.** A
+  lightweight tag is movable without a trace, and the catalog pins plugins by
+  tag — so it is a supply-chain property, not tidiness. But the levels come
+  from a measurement: 155 tags across 19 clones, 14 lightweight, and only ONE
+  repo whose *newest* tag is lightweight. The newest can be re-cut at no cost
+  (`ERROR`); the older ones can only be "fixed" by force-moving an already
+  published ref — the very act the check warns about — so they are exposed
+  once, as a count (`WARN`), never as fourteen findings. Left unrecorded, that
+  `WARN` can never be cleared, which is the `titles` problem again; no
+  acceptance record is built until a repo actually needs one.
 - **No hook until the rule is precise.** A blocking gate that fails a correct
   repository is the mechanism that gets gates switched off.
 
 ## Commands
 
 ```bash
-npm test                                                  # 170 tests
+npm test                                                  # 177 tests
 node scripts/repo-standard-check.mjs --dir "$PWD"         # gate one repo
 node scripts/repo-standard-check.mjs --offline            # no network call
 node scripts/repo-standard-check.mjs --json               # machine output