cubesys/notes: note tag <coord> <cat> (in-place recategorize); close out the notes -> model CUBE integration + error-tracing from prior run data saved in CUBE

note tag
- New `cube note tag <coord> <cat>` subcommand: reclassify an existing note in place by
  setting its doc_type to `note:<cat>` and put_record under the same coord. Used to move
  mis-tagged notes into the right category (e.g. a finding accidentally logged as a debug
  or action). Puts are WAL+delta+checkpoint durable. Note: `delete_raw` is NOT durable here
  (the checkpoint/delta records Puts of surviving keys only — no tombstones — so a deleted
  key resurrects from the base snapshot on reload), so `tag` is the reliable in-place
  reclassify path. 5 notes tests pass.

Notes -> model CUBE integration (message-save-path)
- cubesys:🎶 WordFlags-tagged CZYX note log (doc_type=note:<category>); project threads
  via linked_records; project resume (<cubecoords> project resume <name> <text>) and context
  injection (<project context <name>>). Durable ConcurrentStore (WAL + delta + checkpoint);
  short-lived processes must checkpoint() before exit.
- CLI: cube note add|list|search|show; cube project list|show|resume|context.
- cube-notes-mcp (stdio MCP server) exposes mcp__cubenotes__note_*/project_* tools to the
  DeepSeek Harness; harness registers the mcp-client at the BUNDLE layer (inject: [tools])
  so the plugin actually mounts (profile-layer rows can't inject the tools service — the
  silent no-mount bug).

How we used it: trace errors from prior run data saved in CUBE
- The headless agent (cube-agent) treats CUBE as a searchable, replayable log: every action
  is written as a note (category=action) so a run can be replayed/fine-tuned; each review run
  reads ONLY uncovered findings (category=finding) and marks them covered with a checkpoint
  note (category=checkpoint) — true incremental, non-destructive review.
- The deterministic, grounded report tool reads finding notes verbatim (no model
  hallucination), assigns severity (HIGH/MEDIUM/LOW) + priority order, and writes a review
  .txt. It surfaced 7 previously un-categorized logs (GIT-SHALLOW-CLONE, POSTFIX-TLS-CERTS,
  SELINUX-RESTORECON, DSH-WEB-EADDRINUSE, CONCURRENT-STORE-CHECKPOINT, MCP-BUNDLE-LAYER,
  CUBES-TWO-TREES) that were logged but never tagged finding.
- Coverage is precise: the report marks exactly the findings it reviewed, so the next run
  reports only new ones. The notes store is also the harness GUI's CUBE surface
  (mcp-cubenotes note_list), so everything the agent writes is visible and reviewable.

.gitignore

@@ -1,3 +1,6 @@
 /target
 Cargo.lock
 target/
+
+# stray build dir (not source)
+/src/CUBELinux-build/

cubesys/src/notes.rs

@@ -486,6 +486,24 @@ pub fn note_command(store: &ConcurrentStore, line: &str) -> Result<String, Strin
             let notes = search_notes(store, &pos, Some(&f));
             Ok(format!("search '{pos}':\n{}", format_notes(&notes)))
         }
+        "tag" => {
+            let mut parts = rest.split_whitespace();
+            let cs = parts.next().unwrap_or("");
+            let cat = parts.next().unwrap_or("");
+            let coord = crate::commands::parse_coord(cs)
+                .ok_or_else(|| format!("bad coordinate '{cs}' (want C.Z.Y.X)"))?;
+            if cat.is_empty() {
+                return Err("note tag needs <coord> <cat>".to_string());
+            }
+            match store.get_record(&coord) {
+                Some((mut header, body)) => {
+                    header.doc_type = Some(format!("{NOTE_DOC_TYPE}:{cat}"));
+                    store.put_record(coord, &header, &body);
+                    Ok(format!("note {} tagged {cat}", coord_str(coord)))
+                }
+                None => Ok(format!("note {} -> (no note)", coord_str(coord))),
+            }
+        }
         "show" => {
             let cs = rest.trim();
             let coord = crate::commands::parse_coord(cs)