Add -t/--tag to filter the ruleset via filter_rules_by_meta on the live-analysis path, matching capa.main semantics. A tag that matches nothing errors (exit 1); a tag that selects rules but no matches prints the no-matches message (exit 0). --json renders unchanged with a warning. Update spec and design docs.