incompatible_allow_tags_propagation and aspects cannot coexist

### Description of the bug:

I'm trying to update our codebase so that we can enable `--incompatible_allow_tags_propagation` after the Bazel 6 -> 7 upgrade and I'm finding some surprising behavior.

We have many C++ test targets that set tags `no-remote-exec` and `no-sandbox`. These are the right settings for *test execution*.

We also have aspects that run over the build and try to extract metadata (like for code linting purposes). What I'm finding is that the actions spawned by the aspects for these targets _inherit_ those tags and end up running locally / without the sandbox, which then makes them misbehave.

I'm also finding that it is _impossible_ to undo the propagated tags. The Starlark rule uses `ctx.actions.run_shell`, and I've tried to override `execution_requirements` with an empty dictionary (no luck), a dictionary that has an irrelevant key (no luck either), and tried to "reset" the `no-*` propagated tags to 0 or False values. However, Bazel just checks for the presence of tags, not their values, so it's impossible to say "set `no-sandbox` to 0" and have Bazel re-enable the sandbox.

This feels like spooky-action-at-a-distance and not what I'd expect. Is this feature working as intended? What's the way out here?

### Which category does this issue belong to?

Core

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

_No response_

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

7.6.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse HEAD` ?

```text

```

### If this is a regression, please try to identify the Bazel commit where the bug was introduced with bazelisk --bisect.

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

_No response_

Start by reducing the reported interaction between --incompatible_allow_tags_propagation, aspect actions, and ctx.actions.run_shell using the C++ test tags no-remote-exec and no-sandbox. Check whether execution_requirements can override propagated tags and define what behavior should count as done, since the issue has no minimal reproduction or named test.

Written by the indexing model from the issue text.