So because of limitations of the Criteria API, I decided to bend my domain classes to fit.
I created an entity class for the Tag. I couldn’t even create it as a value object. It had to have its own id.
I feel dirty now. But being able to construct a dynamic query without resorting to string manipulation was more important to me than staying true to the domain.