fix(mirror): isolate downstream tag refs

[realityforge]

Summary

• fetch tag mirrors into mirror-specific remote-tracking refs
• preserve existing downstream tags and isolate same-named mirrors
• require repository changes to land through pull requests

Root cause

Tag fetches explicitly mapped upstream refs/tags/ into the downstream global tag namespace. Tag resolution also assumed that global destination.

Impact

Tag mirror add, pull, update, sync, diff, and status paths no longer create or overwrite downstream tags. Retained Braid remotes keep isolated tracking refs; normal remote cleanup removes them. Existing downstream tags are untouched.

Validation

• bazel run @rules_go//go -- fmt ./...
• git diff --exit-code
• bazel test --test_env=PATH //...
• bazel run @rules_go//go -- vet ./...
• bazel run @rules_go//go -- run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.0 run
• bazel test --test_env=PATH //integration/...

All checks passed; golangci-lint reported 0 issues.