Right now trying to save a widget tag is failing due to "permission unknown". This is because the WidgetTagService save method uses the create_or_update permission but the WidgetTagPermissionEvaluator doesn't have that permission defined. It looks like this might never have worked.
Also, I don't think that create_or_update is correct here. There are different requirements for create vs update from permissions perspective. The WidgetTagService should have two methods (create/update) not just s single save method.