Add tag command for existing local images

[chruffins]

summary

Adds hypeman tag <source> <target>, a top-level command (alongside pull/push) that creates a local Hypeman alias for an image that already exists locally — no pull, no reconvert. The target may use a different repository; both references share the same server-side content.

hypeman tag alpine:latest registry.example.com/app:v1

Matches the prior intent from #65 for the command shape (top-level tag, <source> <target>, body {"target": ...}, auto output prints the normalized image name), without #65's Docker-staging fallback or the one-arg push changes — those are separate concerns.

• POSTs /images/{source}/tag with {"target": "<target>"} (URL-encoded source in the path), the endpoint added in Add local image tagging on shared content storage hypeman#453 (stacked on the content-addressed storage groundwork in Move image references to shared content storage hypeman#449).
• Source must be ready server-side; the server returns 404 for missing sources, 409 for not-ready, 400 for invalid references.
• Global output options work as elsewhere: default auto prints the normalized image name; --format json|yaml|... prints the API response; --transform and --debug apply.
• The request body type is defined locally and the call goes through the SDK's generic client.Post until the generated SDK ships the typed images.tag method (the stlc preview stlc/preview/pr-453 already has it); swapping is a follow-up once an SDK release is out.

Depends on the server endpoint landing first (kernel/hypeman#453); kept as a draft until then.

validation

• go build ./... — pass
• go test ./... -count=1 — pass, including:
  • TestTagCommand_PostsToTagEndpoint — runs the real command tree against an httptest server; asserts method, URL-encoded path (/images/docker.io%2Flibrary%2Falpine:latest/tag), JSON body {"target":...}, and that auto output prints the resolved name
  • TestTagCommand_RequiresSourceAndTarget — usage error unless exactly two references
  • TestTagCommand_SurfacesServerError — server 404 surfaces as a CLI error
• CI push run on this branch: lint pass