Tags are not validated when updating buffers/runs

When creating a new buffer or run, the user-supplied tags are validated by the server.
When using tyger {buffer,run} set <id> --tag ..., the tags are not validated.

Example:

$ tyger buffer create --tag a@=b
Error: InvalidInput: Tag keys must contain up to 128 letters (a-z, A-Z), numbers (0-9) and underscores (_)

$ tyger buffer create
2ui2lm6hwrxexoxuwnosd6l3me

$ tyger buffer set 2ui2lm6hwrxexoxuwnosd6l3me --tag a@=b
{
  "id": "2ui2lm6hwrxexoxuwnosd6l3me",
  "createdAt": "2025-04-09T14:32:51.357197Z",
  "location": "westus2",
  "tags": {
    "a@": "b"
  },
  "eTag": "17471511304344921275"
}

Question: Should they also be validated when they are used for filtering multiple buffers/runs, e.g. for tyger buffer list --tag a@=b$?

Start with the implementations of tyger buffer set, tyger run set, and the corresponding create commands to find where tags are validated. Reproduce the invalid-tag example, then inspect the list filtering path to determine whether the same validation applies there; done means update behavior is consistent with creation and covered by tests.