[EPIC] Tag-based access control: drive authorization from tag-bound policies

### Describe the proposal

Let authorization read tags, so that classification can drive access. Today an organization that already labels tables `certified` or `pii` must still enumerate grants object by object: new objects need new grants, dropped objects leave stale ones, and the rule exists only as the accumulated set of grants someone remembered to issue.

An access rule is a `Policy` of type `system_access_control` whose `content` carries an action, a role condition and a scope. The policy is bound to a tag; any object carrying that tag becomes subject to the rule. The role is a condition matched against the caller's expanded roles rather than a principal, and the rule composes with RBAC instead of replacing it.

Design doc: #12757 (discussion #12619).

### Task list

- [ ] #12759 — design doc

Further subtasks will be added once the open questions are resolved in design doc

Start with design doc #12757 and discussion #12619, since the proposal says implementation subtasks depend on resolving open questions there. Review how tag-bound policies, role conditions, scopes, and RBAC composition should work. This epic is done when the design is settled and concrete implementation subtasks have been added beyond #12759.

Written by the indexing model from the issue text.