feat(PL-6433): introduce org-local+lock tag

[davidmdm]

When we introduced the !org-local we didn't fully account that marking a tag as org-local would disallow a user to mark that field as locked for the local org.

This PR adds a new tag to combine the concept of locked and org-local.

---

Note

Low Risk
Small, localized YAML tag and predicate changes with a focused test; no auth or external API surface.

Overview
Adds a new custom YAML tag !org-local+lock so a field can be both org-scoped and locked for downstream orgs, which !org-local alone could not express.

Tag constants in tags.go replace inline strings, and CustomTags now includes the new tag. IsLocked and IsOrgLocal treat !org-local+lock as locked and org-local respectively, so existing merge/purge/TODO behavior applies without separate code paths.

A merge test confirms same-org merges surface TODO for locked values and cross-org merges drop the key like plain !org-local.

^{Reviewed by Cursor Bugbot for commit ae1d031. Bugbot is set up for automated code reviews on this repo. Configure here.}

[j-martin]

Let's not forget to update the https://github.com/nestoca/catalog/#what-are-the-org-local-tags-in-the-yaml-and-what-do-they-do

We probably want a table to explain it.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit dbd0862. Configure here.}

[cursor]

Org-local lock becomes TODO merge

High Severity

Treating !org-local+lock as locked via IsLocked makes Merge rewrite those source scalars to TODO before merge (same as !lock), so same-organization promotions no longer copy org-local values into new or missing keys. That diverges from plain !org-local behavior and can leave promoted releases failing locked-TODO validation.

Additional Locations (1)

• internal/yml/merge.go#L140-L141

 

^{Reviewed by Cursor Bugbot for commit dbd0862. Configure here.}