feat(store): canonicalize tags on the write path (#653 choke-point)

[norrietaylor]

What

Follow-up to #680 (Phase 1). Phase 1 backfilled existing tags once; this is the complementary guarantee that new writes stay canonical — without it, the graph silently re-fragments as the feed poller ingests new items (it currently never applies the alias map).

Stacked on #680. Base is feat/653-tag-controlled-vocab because this needs canonicalize_tags + config.tags.aliases. Retarget to main once #680 merges.

Changes

• Single write-path choke-point in DuckDBStore: store / store_batch / update run each entry's tags through _canonicalize_entry_tags (alias substitution + optional namespace normalization + order-preserving dedupe). update() re-fetches to build its return, so the returned Entry reflects the canonical tags.
• Three new constructor params (tag_aliases, tag_reserved_prefixes, tag_normalize_namespaces), wired from config.tags.* at all eight config-bearing construction sites (server ×2, webhooks, cli ×5). Empty alias map + normalization off is a true no-op → an un-configured store writes byte-for-byte as before.

Why just the store (not the merge sites too)

The original design floated also canonicalizing at the poller / classify / gh-sync merge sites. That turns out to be redundant for correctness: every ingest path persists through the store, and the choke-point canonicalizes and dedupes on the canonical form at persist time. So one choke-point gives the full guarantee with far less surface than touching three call sites. (Entry stays validate-only — no config in the model layer.)

Deferred

Namespace-membership enforcement (known_namespaces + off/warn/strict gating of unknown namespaces) is split to a follow-up. This PR is pure canonicalization.

Testing

• store / store_batch / update canonicalize + dedupe; update return reflects canonical tags; namespace-normalization path; inert-by-default (tags verbatim with no config).
• Full suite: 3235 passed, 79 skipped; mypy --strict src/ clean; ruff check src/ tests/ clean.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 118f685d-0907-4fdd-81f5-24c74db141e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}