Bound diagnostic tags and verify the real diagnostic CLI entry

[Pigbibi]

Changes

• Use a short fixed diagnostic tag and reject a combined service/tag length over the provider limit before authentication or staging.
• Preserve the existing candidate pin, old 100% traffic and all configuration, IAM and Scheduler checks.
• Classify the specific traffic-tag budget rejection without printing resource names.
• Run the package-based diagnostic entry correctly and protect it with isolated-process tests without PYTHONPATH.

Validation

• 79 targeted diagnostic, stage and workflow tests: PASS.
• Ruff, actionlint and diff checks: PASS.
• Independent review found the direct-script import issue; module invocation and actual isolated CLI validation now pass.
• Actual read-only failure diagnosis confirms one invalid-name audit failure and the ready serving revision at 100%; no broker read was triggered.