Finish semaphore-tag-sync two-tier rollout (prod config, dry-run validate, flip live)

[jung-thomas]

Goal

Finish the semaphore-tag-sync two-tier rollout (#2184): adopt the ~160 existing hand-curated tags and pick up genuinely new tags, without importing all ~21k SES terms.

What's landed (PR: two-tier sync)

• Two-tier applier (srv/lib/semaphore-sync/applier.js): Tier 1 adopts/updates existing rows by semaphoreId then by name, backfilling only taxonomy-owned fields (label, name, titlePath, semaphoreId) — never the editorial flags isActualTag/isInterestItem. Tier 2 INSERTs an unmatched term only when its SES class is in semaphore.sync.intakeClasses, and forces new rows inert (both flags false).
• Dry-run class histogram in the run summary (classHistogram, a pre-formatted string) so the FILTER / intake classes can be chosen from real data.
• Mislog fix (Scheduler logs SUCCESS when a job returns ok:false (soft failure) #2478): ok:false returns now record FAILED.
• dryRun defaults true; intakeClasses empty ⇒ adopt-only.

Remaining to finish (tomorrow)

• Run an in-app dry run against prod SES and read classHistogram from the SUMMARY.
• Decide the intake mechanism from the histogram (do NOT decide silently — Tom's call):
  • server-side SES semaphore.sync.filter (recommended — shrinks the 61 MB fetch), vs
  • post-fetch semaphore.sync.intakeClasses allowlist; and which SES class(es) define a "wanted" new tag.
• Set the chosen semaphore.sync.* config in the prod DB (per Tom: set directly in DB now; Admin-UI backfill tracked in Admin UI config backfill for semaphore sync #2477).
• Validate with a second dry run: expect updated ≈ 160 (existing adopted), inserted = only genuinely-new allowlisted terms, editorial flags intact on existing rows.
• Flip semaphore.sync.dryRun=false in prod DB — only after the dry run above validates.
• Rotate the compromised Semaphore API key (a key was pasted into a chat and must be rotated regardless of the sync work).

Guardrails

• Feature flag + all tuning are DB config, never env vars.
• Do NOT flip dryRun=false until a dry run shows the expected adopt/insert/flag outcome.
• cf target before any prod action.

Refs: #2184, #2477 (Admin UI), #2478 (mislog).