[feature]: Add missing tag policy CLI coverage (retention commands + immutable update)

## Problem
What problem does this feature solve?
Describe the limitation or pain point you are facing.

The CLI currently has partial project policy coverage under `harbor tag`:
- Immutable rules support create/list/delete but miss update.
- Retention policy workflows are not exposed under `harbor tag`.

This creates a functional gap between CLI and Harbor policy capabilities and reduces operator efficiency for policy operations.

## Proposed Solution
Describe the feature or behavior you would like to see.

Add the missing policy capabilities directly under `harbor tag` with default interactive-first behavior and with flag support.

### Commands that will be available
- `harbor tag immutable update [PROJECT_NAME]`
- `harbor tag retention metadata`
- `harbor tag retention get [PROJECT_NAME]`
- `harbor tag retention create -f `
- `harbor tag retention update [PROJECT_NAME] -f `
- `harbor tag retention delete [PROJECT_NAME]`
- `harbor tag retention run [PROJECT_NAME] [--dry-run]`
- `harbor tag retention executions list [PROJECT_NAME]`
- `harbor tag retention executions stop [PROJECT_NAME]`
- `harbor tag retention tasks list [PROJECT_NAME]`
- `harbor tag retention tasks log [PROJECT_NAME]`

### Issue Tracker
| Id | Issue | PR |
|---|---|---|
| 1 | Immutable | #802 |
| 2 | Retention Create| #564 |
| 3 | Retention List | #564 |
| 4 | Retention Run | |
| 5 | Retention Update | |
| 6 | Retention Delete | #564 |
| 7 | Retention Executions | |
| 8 | Retention Tasks | #954 |

### Expected behavior
- Keep `tag` namespace (no new top-level policy namespace).
- Support non-interactive execution through flags (`--retention-id`, `--execution-id`, `--task-id`, `--file`).
- Default to interactive selectors when IDs/project names are not explicitly provided.

## Alternatives Considered
Have you considered any alternative approaches or workarounds?
path.

## Additional Context
Add any other context, examples, or references here.