fix(audit): validate phase0 artifact tag inputs

Add shared artifact-tag normalization/validation and apply it to capture, drift, and prune scripts for --tag/--report-tag/--baseline-tag paths. Architecture diagrams reviewed; no flow changes required.

scripts/check-phase0-baseline-backend-drift.ts

@@ -3,6 +3,7 @@
 import { mkdir, readdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { parseArgs } from 'node:util';
+import { normalizeArtifactTag } from '../src/audit/artifactTag.js';
 import {
   comparePhase0BaselineDrift,
   evaluatePhase0BaselineDriftGate,
@@ -366,10 +367,14 @@ async function main(): Promise<void> {
 
   const artifactsDir = resolve(values['artifacts-dir'] ?? 'docs/plans/artifacts');
   const backends = parseBackends(values.backend);
-  const candidateTag = values.tag;
-  const baselineTag = values['baseline-tag'];
+  const candidateTag = values.tag
+    ? normalizeArtifactTag(values.tag, '--tag')
+    : undefined;
+  const baselineTag = values['baseline-tag']
+    ? normalizeArtifactTag(values['baseline-tag'], '--baseline-tag')
+    : undefined;
   const format = parseFormat(values.format);
-  const reportTag = values['report-tag'] ?? isoDateTagNow();
+  const reportTag = normalizeArtifactTag(values['report-tag'] ?? isoDateTagNow(), '--report-tag');
   const writeDefaultArtifacts = Boolean(values['write-default-artifacts']);
   const maxAgeHours = parseOptionalNumber(values['max-age-hours'], '--max-age-hours');
   if (typeof maxAgeHours === 'number' && maxAgeHours < 0) {