Extends #2971 fix to also cover nodes that authenticate as users but become tagged immediately via --advertise-tags. When RequestTags are approved by policy, the node's expiry is now disabled, consistent with nodes registered via tagged PreAuthKeys.