docs: propose the S3 object-tagging design (VersionState second tenant)

[frrist]

Design doc for S3 object tagging, following the doc-then-impl stack workflow — stacked on #78 (the object-lock implementation), because tagging is the second tenant of the version-state tree that design built. Rebases down the stack as #77/#78 land.

Tagging rides the lock design's format exactly as planned: the Tags field is already reserved on VersionState, so this is handlers and conformance rows with no format change. The spec pins the three deltas from lock:

• No bucket gate — tags work on any bucket, unversioned included; the check order is the lock order minus the lock-enabled step, and tags on unversioned buckets make the write-rule discard cleanup live for real.
• Absent state is a success — a version without tags answers an empty tag set (200), where lock answers a 400 sentinel.
• A true unset exists — DeleteObjectTagging is what the state tree's empty-block elision rule was written for.

Creation-time stamping covers the x-amz-tagging header on PUT (parsed backend-side via backend.ParseObjectTags, before ingest), the copy tagging directive (controller-defaulted to COPY: inherit the resolved source version's tags; REPLACE takes the header), and the multipart session carry. GET/HEAD gain the x-amz-tagging-count echo from the same state-block fetch as the lock headers.

Implementation follows as the stacked PR from frrist/feat/object-tagging.

🤖 Generated with Claude Code

[hannahhoward]

My eyes are glazing a bit, but this looks simple enough. LGTM