feat(tags): Add support to bulk assign tags

[Rutvik G (rutvik-gs)]

Problem

censys tags assign can only take assets one at a time. The platform already exposes an async bulk endpoint to assign tags in bulk by running a cenql query.

The mode boundary matters as bulk must never be inferred from a missing argument, because guessing wrong here
tags a very large number of assets.

Technical Changes

Bulk rides as flags on the existing assign verb, not a bulk-assign subcommand — the async
path renders a different payload (TagOperation vs per-asset results), which splits cleanly in
Run.

• internal/command/tags/assign.go — --query, --max-assets, --wait/-w, --timeout,
  --yes/-y. Modes are mutually exclusive in PreRun and bulk-only flags without --query are
  typed errors, not silent no-ops. Bulk always confirms (tag, query, effective cap) unless
  --yes, and refuses in a non-TTY without it. --wait maps the terminal status onto the exit
  code: succeeded/limit_reached → 0 (the latter warns), failed/cancelled → non-zero with
  the payload still rendered.
• internal/command/tags/operationwait.go (new) — wait plumbing that operations get owned
  privately: parseWaitFlags, waitForOperation, terminal-status → exit code, track hints.
  operations_get.go moves onto it; TAGS-12 reuses it.
• internal/app/tags/bulk.go (new) — BulkAssign: rejects a blank query, resolves a tag name
  via the existing resolveTagID, submits, maps the operation. TAGS-12's BulkUnassign joins it.
• internal/pkg/clients/censys/tags.go — BulkCreateTagAssignments. Mocks regenerated; no
  SDK bump needed.
• internal/command/tags/{short,utils}.go, internal/app/tags/operations.go — shared
  helpers extracted, no behavior change: renderOperationDetail, confirmAction (the block
  delete/unassign each copied), printNote, mapOperationResult.
• --timeout 0 on operations get --wait expired before the first poll. It now means "no limit",
  matching the global --timeout-http; a negative value is a typed error.
• --quiet is now honored for the index-lag notes in assign/unassign, which printed
  unconditionally. Aborts and errors still always print — outcomes, not notes.

How to Test

go build ./... && go test ./internal/... && make cover-check   # 61.1%, threshold 30%
CENCLI_ENABLE_E2E_TESTS=true go test ./cmd/cencli/e2e -run 'TestE2E/tags' -v

Live, on a throwaway tag (bulk mutates at scale, so nothing below is automated):

TAG=tags11-$(date +%s) && ./bin/censys tags create $TAG
./bin/censys tags assign $TAG --query 'host.services.port: 22' --max-assets 25 --yes
./bin/censys tags operations get $TAG <op-id>                        # track hint from above
./bin/censys tags assign $TAG --query 'host.services.port: 22' --max-assets 25 --wait --yes
./bin/censys tags assign $TAG --query 'host.ip: *' --max-assets 5 --wait --yes   # limit_reach
./bin/censys tags assign $TAG --query 'host.ip: *' --wait --yes                  # Ctrl-C mid-poll
./bin/censys tags assign $TAG --query 'host.services.port: 22' --max-assets 5    # interactive
./bin/censys tags delete $TAG --yes

[Ben Schwartz (btschwartz12)]

LGTM!