Adds metadata.domain.tags with TagRegistry (per-Source bookkeeping) and
TagCanonicalizer (case-corrected name resolution against OM). Migrates
the Snowflake connector to the new architecture; other connectors stay
on the legacy context.tags flow (strangler pattern).

TagRegistry interns shared TagLabel instances by (classification, tag,
label_type, state) and rebinds the per-entity dict on scope clear. On a
schema with ~120k tag attachments and 21 unique tags, peak heap drops
from ~112 MB to ~24 MB.

Public get_*_tag_labels methods on the database service base are
unchanged; non-Snowflake DB connectors are not touched.

- Drop None defaults from `TagRegistry.attach()` description params
  (required `str | None`); normalize None -> "" inside
  `_build_pending_record` so the OM schema's required-non-null Markdown
  contract is owned at the registry boundary, not at every caller.
- Fix `yield_database_tag` missing registry drain (PR review).
- Fix `clear_scope` lock-order race that left labels visible after the
  scope was marked cleared (PR review).
- Resolve basedpyright errors:
  - `Either` and `TopologyNode` use Form 3 Pydantic v2 fields
    (`Annotated[X, Field(...)] = default`) so static checkers see the
    defaults.
  - `cast("str", fqn.build(...))` at the 13 sites that feed
    `fqn.build(...)` results into FQN-typed args.
  - Scoped `# pyright: ignore[reportAttributeAccessIssue]` on
    `TopologyContext` dynamic-attribute accesses (matches the codebase
    pattern of grandfathering 8.4k+ such errors via baseline).
- Populate `stackTrace` on the three snowflake tag-error
  `StackTraceError`s so the Status UI shows the trace, not just the
  one-line summary.
- Rewrite three snowflake tag-inheritance tests to drive the real
  registry attach + inheritance walk after `get_tag_label` was removed:
  - `test_schema_tag_inheritance`
  - `test_database_tag_inheritance`
  - `test_tag_value_precedence` (one attach intentionally passes
    `None` descriptions to exercise the registry's normalization)

…cascade

Reverting `Either.left`/`Either.right` to the original
`Annotated[Optional[T], Field(default=None, ...)]` form. The Form 3
shape (`Annotated[T | None, Field(...)] = None`) introduced in the
prior commit caused pyright to eagerly bind `T` from the literal-None
default at every no-arg construction site like `Either(left=...)`,
resolving them to `Either[Unknown]`. Because `Either[T]` is invariant,
those failed to satisfy declared generator return types like
`Iterable[Either[CreateTableRequest]]` — surfacing 45 latent
reportReturnType errors across sample_data, dbt, sas, qliksense, sigma,
common_db_source, common_broker_source, amundsen, sink/metadata_rest.

Form 2 wraps the default inside `Annotated` metadata where pyright
treats it as opaque: it sees "this field has a default" (so construction
sites pass) but doesn't eagerly bind `T` from None. Context-driven
inference works, no cascade.

`TopologyNode` stays in Form 3 — its fields are concrete-typed
(`list[str] | None`, `bool`), no Generic-T to bind.

…-check

Two refinements from a fresh round of Copilot review:

1. **Merge ``_run_state_lock`` and ``_scope_state_lock`` into a single
   ``_lock``.** Two locks were a smell: every ``attach()`` already needed
   both, the lock-acquisition order varied across methods (``attach`` does
   one order, ``stats`` the reverse — fragile if any future code held both
   simultaneously), and ``RLock`` was used defensively without any actual
   re-entry. One lock = single mental model, no ordering invariant, deadlock
   impossible.

2. **Move ``_intern_tag_label`` invocation inside the cleared-scope
   gate** (Copilot review). With one lock, the cleared-check, intern,
   label-append, and pending-update all happen in one atomic critical
   section — so when a scope is already cleared, no TagLabel is interned
   into ``_tag_label_cache``. Verified deterministically: 30 threads
   attaching to a pre-cleared scope all raise and the cache stays empty.

3. Reword the inline ``vars(self).setdefault`` thread-safety comment in
   ``database_service.py`` to drop the misleading Python 3.14 reference
   (project targets 3.10+) — just point at the official
   ``threadsafety.html`` doc.

…er params

End-to-end tightening to prevent the empty-description / overwrite path
flagged in PR review. Three coordinated changes:

1. **``Canonical.description`` is now ``str`` (required)** instead of
   ``str | None``. The canonicalizer always seeds with the caller-provided
   default and only overrides with a non-empty server value, so the
   resolved description is invariably a real string. Removing the
   Optional makes that invariant visible at the type level.

2. **Rename canonicalizer parameters to make their fallback semantics
   honest**:
   - ``classification(name, description)`` →
     ``classification(name, default_description)``
   - ``tag(classification_name, tag_name, tag_description)`` →
     ``tag(classification_name, tag_name, default_tag_description)``

   The parameter is used to seed the Canonical when no system match
   exists in OM, and as a fallback when an OM match has an empty
   description — never as the value to set on an existing entity. The
   rename signals "if I have to invent this, here's what to write down"
   rather than "set the description to this." Snowflake call sites use
   the new kwargs explicitly for self-documenting reads.

3. **Tighten ``TagRegistry.attach`` and ``_build_pending_record`` to
   required ``str`` for both descriptions** (was ``str | None``). With
   ``Canonical.description`` now ``str``, every caller can pass through
   without an ``or ""`` shim. ``_build_pending_record`` drops the
   defensive ``Markdown(x or "")`` for clean ``Markdown(x)``.

Net effect: no possible code path sends ``None`` or relies on an
``or ""`` fallback that would clobber a server-side description. The
schema's required-Markdown contract is enforced at every layer above
the wire.