fix(audit): validate phase0 artifact tag inputs

Add shared artifact-tag normalization/validation and apply it to capture, drift, and prune scripts for --tag/--report-tag/--baseline-tag paths. Architecture diagrams reviewed; no flow changes required.

scripts/prune-phase0-baseline-artifacts.ts

@@ -3,6 +3,7 @@
 import { mkdir, readdir, rm, writeFile } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { parseArgs } from 'node:util';
+import { normalizeArtifactTag } from '../src/audit/artifactTag.js';
 import {
   planRollingPhase0ArtifactRetention,
   type Phase0RollingArtifactRetentionPlan,
@@ -103,7 +104,7 @@ async function main(): Promise<void> {
   const keepPerFamily = parseOptionalInteger(values['keep-per-family'], '--keep-per-family') ?? 8;
   const apply = Boolean(values.apply);
   const format = values.format ?? 'text';
-  const reportTag = values['report-tag'] ?? isoDateTagNow();
+  const reportTag = normalizeArtifactTag(values['report-tag'] ?? isoDateTagNow(), '--report-tag');
   const writeDefaultArtifacts = Boolean(values['write-default-artifacts']);
 
   if (format !== 'text' && format !== 'json') {