Add multiple-valued tag assignments and AllOf filtering

## Parent

#792

## What to build

Extend controlled and free-text tag definitions with `Multiple` cardinality. Workflow authors can assign several effective values to one logical workflow definition, Studio edits and renders the collection without duplicate semantic values, and readers can use `AnyOf`, `AllOf`, and `NoneOf` while combining different tag-definition clauses with `AND`. Keep grouping limited to marker and single-valued tags so one workflow definition is never duplicated across list groups.

Covers parent user stories 4, 24, 27–29, 51, 56, and 76.

## Acceptance criteria

- [ ] Catalog managers can create `Controlled`/`Multiple` and `FreeText`/`Multiple` definitions; marker tags remain inherently single-valued.
- [ ] Studio provides mode-appropriate multi-value editors and renders de-duplicated effective values on workflow-definition rows and details.
- [ ] Controlled values de-duplicate by stable identity and free-text values de-duplicate by normalized comparison key while preserving readable display text.
- [ ] The server-side query supports `AnyOf`, `AllOf`, and `NoneOf` for multiple-valued tags with the parent PRD's exact semantics and bounded values-per-clause validation.
- [ ] Clauses for different tag definitions combine with `AND`; values within a clause combine with `OR`; arbitrary nested Boolean expressions remain unsupported.
- [ ] Invalid mode/cardinality/operator combinations fail validation rather than being ignored.
- [ ] Marker and single-valued grouping behavior remains intact; multiple-valued tags are not offered as grouping dimensions in Server contracts or Studio.
- [ ] The origin-aware reducer unions values across origins and de-duplicates identical assertions while preserving backing-origin detail, without enabling non-manual writes in version 1.
- [ ] Cardinality and value mode become durably immutable after the first assignment has ever existed, even when all assignments are later removed.
- [ ] Audit facts, post-commit events, optimistic revisions, tenant isolation, and permanent-delete cleanup correctly handle multi-value changes.
- [ ] API acceptance, Studio browser, operator/cardinality matrix, and Groundwork provider-conformance tests extend the shared seams and prove deterministic bounded behavior.

## Blocked by

- #801
- #800

Start with parent #792 and the blocked prerequisites #800 and #801, then review the shared API acceptance, Studio browser, operator/cardinality matrix, and Groundwork provider-conformance test seams named here. Done means all listed multi-value, filtering, grouping, immutability, audit, isolation, cleanup, and deterministic-behavior criteria are covered without unsupported nested Boolean expressions.

Written by the indexing model from the issue text.