fix(gate): use '.' separator in build tags so ADO doesn't reject ':' in REST path

[Copilot]

Summary

ADO puts build tags in the REST request path (PUT …/builds/<id>/tags/<tag>), and ASP.NET's request-path validator rejects : with "A potentially dangerous Request.Path value was detected". The gate emitted tags like pr-gate:passed, so every PR-gated pipeline failed on the addBuildTag step.

Switch the tag separator from : to . at all gate call sites:

• bypass.ts → ${tag_prefix}.passed
• selfcancel.ts → ${tag_prefix}.skipped
• predicates.ts (failed-check path) → ${tag_prefix}.${tag_suffix}

- addBuildTag(`${spec.context.tag_prefix}:passed`);
+ addBuildTag(`${spec.context.tag_prefix}.passed`);

• Regression tests in bypass.test.ts / selfcancel.test.ts assert the emitted ##vso[build.addbuildtag] line contains no :; existing gate-tag expectations updated to the dot form.
• Defensive Rust test (test_tag_prefix_has_no_colon) confirms tag_prefix itself is colon-free for both PullRequest and PipelineCompletion.

Blast radius: consumers filtering on the old colon-form tags (pr-gate:passed, etc.) must update to the dot form. The format is internal to the gate, so impact is expected to be near-zero.

Test plan

• npm test (ado-script): 251 tests pass; tsc --noEmit clean
• cargo test --bin ado-aw test_tag_prefix_has_no_colon passes