For example:
First, I register the device with a 'SETUP' tag.
Then I run a setup pipeline and at the end of that pipeline it removes the 'SETUP' tag and replaces it with a 'PRODUCTION' tag.
Is this possible?
Normally, the Tags of deployment agent can be customized only on project-level. And the same deployment agent can be assigned different tags in different projects. Unlike the properties listed in Capabilities, the Tags is not a common property that can be shared cross-projects.
I checked and tried with the related API (Agents, Deploymentgroups) and Azure CLI (az pipelines agent), all of them are based on organization-level. I did not find any interfaces can be used to deal with the deployment agent on project-level.
So, in your case, currently we seem have no methods to automatically edit the tags of the deployment agent in the pipeline run. You may need to manually edit the tags.