fix(tag): make tag creation atomic

[dentiny]

Closes #8460

Hi team, I found for tag creation, in the current implementation, we use two IO operations: check existence first then create, which could lead to data race and tag loss under concurrent accesses.

In this PR, I updated the operation to leverage PutOption to achieve put-if-absent semantics.

[lance-gatekeeper]

❌ Gate recommendation: request changes.

The atomic-create direction is correct, but acceptance requires ref creation to fail closed on every supported backend. The current direct conditional PUT regresses unreliable backends from rejecting an ordinary duplicate to silently overwriting it.

Use a backend-aware conditional-publish abstraction and reject unsupported or unreliable stores, or coordinate them with a ref-name-keyed distributed lock.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[lance-gatekeeper]

❌ Gate recommendation: request changes.

1 fixed / 1 new. The backend-aware atomic-create revision resolves the COS overwrite risk, but the new direct dependency leaves the excluded Python and Java lockfiles stale. Regenerate both lockfiles so every supported locked build uses the current lance-io dependency graph.

[lance-gatekeeper]

✅ Gate recommendation: approve.

2 fixed / 0 remain. The backend-aware create path now fails closed on COS and preserves atomic ref publication on supported stores; both excluded binding lockfiles are synchronized with the new dependency. This keeps the fix at the storage boundary without adding distributed coordination.

[dentiny]

I'm not sure on the PR page it shows failure, but all CI pipelines seem to pass.