feat(images): match image tags in the Tags filter, search and inspector

The workspace Images listing now admits a file under a Tags filter when
every requested tag is carried by its linked positive or its current image
tag set, and q also matches image tag names (case-folded substring). Image
tags count only while a byte record is verified at the file's present
(size, mtime_ns) (spec amendment S1): the tagged records are streamed
once, only listed files carrying a filter tag or q hit are stat'ed, and
their linked positives are read through the file_path index so tags,
category, rating and the positive count combine.

The rooted inspector envelope gains a validated image_tags facet
(current / none / unavailable) read at the inspection's own stable stat.
A failed image-tag read fails a Tags filter like a failed link read and
degrades a q search to no image tags; plain listings read none. Legacy
gallery and search responses are unchanged.

tests/test_api_annotations.py

@@ -930,11 +930,13 @@ class TestEnvelopes(AnnotationAPITestCase):
         )
         self.assertEqual(resp.status, 200)
         data = await self.json_of(resp)
+        # Additive only: B3 adds the image_tags facet beside the Library facts.
         self.assertEqual(
             sorted(data),
             [
                 "file",
                 "image",
+                "image_tags",
                 "inspection_version",
                 "library",
                 "metadata",
@@ -945,6 +947,7 @@ class TestEnvelopes(AnnotationAPITestCase):
             ],
         )
         self.assertEqual(sorted(data["image"]), ["filename", "path", "root_index"])
+        self.assertEqual(data["image_tags"], {"state": "none", "tags": []})
         self.assertEqual(
             sorted(data["library"]),
             [