state: give another user's key on a tagged machine a new device

Only a key that speaks for a tagged node re-authenticates it: a tagged
key, or one of the user it was tagged from. Another user's key or login
adds that user's own device, or only wakes the node under its node key.

Fixes ANT-2026-AWGRB7O1

(cherry picked from commit e1de83cbdf, adapted: inline PAK re-register path, no servertest compat table)

.github/workflows/test-integration.yaml

@@ -365,7 +365,7 @@ jobs:
           - TestTagsUserLoginReauthWithEmptyTagsRemovesAllTags
           - TestTagsAuthKeyWithoutUserInheritsTags
           - TestTagsAuthKeyWithoutUserRejectsAdvertisedTags
-          - TestTagsAuthKeyConvertToUserViaCLIRegister
+          - TestTagsAuthKeyWithoutUserCLIRegisterAddsUserDevice
           - TestTaggedNodeLogoutReloginSingleUseKeyOnline
           - TestTaggedNodeLogoutReloginReusableKeyOnline
           - TestTagsOIDCReauthAddOwnedTag