fix(acl): own lab inventory tags (TIN-2639)

[Jesssullivan]

Why

lab inventory currently asks the Tailscale reconciler to assign tag:tinyland-lab and tag:tinyland-lab-storage, but the tailnet ACL SSOT defines neither tag. This is the explicit authority stop condition for the TIN-2639 OAuth cutover.

Change

• add typed constants for both inventory tags
• assign both to the same admin and dollhouse-admin ownership boundary used by the adjacent lab tags
• do not add any ACL/grant connectivity beyond tag assignment authority

Evidence

• nix develop --command dhall format --check constants.dhall fragments/core.dhall
• nix develop --command just check
• nix develop --command just build
• generated policy contains 25 tag-owner entries
• git diff --check

No live ACL push, device tag write, credential mutation, or secret output occurred.

Linear: TIN-2639

[github-actions]

⚠️ ACL Validation

Validation

tailnet-acl dev shell
  dhall:         1.42.3
  dhall-to-json: 1.7.12
  just:          just 1.46.0
Loading local policy from /home/runner/work/tailnet-acl/tailnet-acl/generated/policy.json ...
Fetching live ACL from taila4c78d.ts.net ...

Validation FAILED: local policy differs from live.
acls: OK
autoApprovers: OK
grants: OK
groups: OK
hosts: OK
nodeAttrs: OK
ssh: OK
tagOwners: MISMATCH
  key 'tag:tinyland-lab': ONLY IN LOCAL
  key 'tag:tinyland-lab-storage': ONLY IN LOCAL

Diff against live

tailnet-acl dev shell
  dhall:         1.42.3
  dhall-to-json: 1.7.12
  just:          just 1.46.0
Fetching live ACL ...

Changes to apply:
  ~ tagOwners: changed

(dry run, no changes made)