vault-tag procedures now take/return a tag record with type and content fields. Procedures that use them need to stop thinking in terms of raw strings!

Tags that don't start with ( are old-format and auto-upgraded to (snapshot . ...content...) on reading.