revert(engine): hold cloud tag preservation from release (#364)

PR #360 merged with unresolved functional findings: enrollment can race registration and lose authoritative tags; legacy client-supplied cloud tags become trusted indefinitely; and reserving the entire cloud namespace breaks client tag round-tripping. Keep #355 and #358 releasable while the tag-authority contract is hardened separately.

Session-Id: 01a060f2-87c5-7d21-bf8f-515f3e9cbfdd