publish: ApiTagDescription PUT fails cross-service — properties.tagId references source APIM service #312

Describe the bug

Publishing extracted artifacts to a different APIM service fails with HTTP 400 on every ApiTagDescription resource:

ERROR PUT apitagdescription/<api-id>/<tag-id>: HTTP 400: {"error":{"code":"ValidationError","message":"Resource id '/subscriptions/.../resourceGroups/.../providers/Microsoft.ApiManagement/service/<SOURCE-SERVICE>/tags/<tag-id>' references APIM service '<SOURCE-SERVICE>', which is different from the service '<TARGET-SERVICE>' targeted by the request. Cross-service resource references are not allowed.","details":null}}

Root cause

The extractor saves the GET response verbatim, so tagDescriptionInformation.json contains properties.tagId with the full ARM path of the source service's tag:

"properties": {
  "tagId": "/subscriptions/.../service/<SOURCE-SERVICE>/tags/<tag-id>",
  ...
}

The publisher sends the body as-is. Newer APIM api-versions validate ARM references inside PUT bodies and reject any that point at another service.

This is the same family of bugs as #285, which stripped the top-level id and rebuilt diagnostic loggerId, but missed properties.tagId on ApiTagDescription.

Expected behavior

Cross-service publish of tag descriptions succeeds. Per the ARM contract (TagDescriptionCreateParameters), the PUT body only accepts description, externalDocsUrl, externalDocsDescription — tagId is response-only, the tag is identified by the request URL (.../apis/{apiId}/tagDescriptions/{tagDescriptionId}). The publisher should strip properties.tagId before PUT.

Steps to reproduce

1. apiops extract from service A (API has tags with tag descriptions)
2. apiops publish the artifacts to service B
3. Every apitagdescription PUT fails with the ValidationError above