feat: implement universal OCI tagging policy engine

- Decentralize tagging expansion from driver-specific logic.
- Implement TaggingPolicy and TagMetadata in blue-build-utils.
- Support placeholder resolution ({tag}, {os_version}, {timestamp}, {short_sha}).
- Add tagging field to Recipe schema for data-driven configuration.
- Maintain legacy fallback for backward compatibility.
- Ensure cross-driver consistency (GitHub, GitLab, Local).
- Optimized regex evaluation with pre-compiled policy engine.
- Enhanced error handling with miette for senior-level robustness.

Closes #746

Assisted-by: Antigravity via Claude-3.5-Sonnet

Author: nklowns

utils/src/tagging.rs

@@ -42,16 +42,23 @@ pub fn apply_tagging_policies(
 ) -> Result<Vec<Tag>> {
     let mut expanded_tags = Vec::new();
 
+    // Pre-compile regexes for each policy
+    let compiled_policies = policies
+        .iter()
+        .map(|p| {
+            regex::Regex::new(&p.match_tag)
+                .map_err(|e| miette::miette!("Invalid regex in tagging policy '{}': {}", p.match_tag, e))
+                .map(|re| (re, p))
+        })
+        .collect::<Result<Vec<_>>>()?;
+
     for alt in alt_tags {
         let alt_str = alt.as_str();
 
-        let policy = policies.iter().find(|p| {
-            regex::Regex::new(&p.match_tag)
-                .map(|re| re.is_match(alt_str))
-                .unwrap_or(false)
-        });
+        // Find the first policy where the regex matches the alt-tag
+        let policy = compiled_policies.iter().find(|(re, _)| re.is_match(alt_str));
 
-        if let Some(policy) = policy {
+        if let Some((_, policy)) = policy {
             for template in &policy.tags {
                 let mut meta = metadata.clone();
                 meta.tag = Some(alt_str);