Tag without pull/push?

No, it’s not possible.

Do you see how this could wreak havoc with access control levels if allowed? Just because I have access to registry A and B, does not imply that registry A or B should have access to the other.

Check out the docker tag command, which might well solve your problem in the first place. If you docker tag jeremypumphrey/foo:latest jeremypumphrey/foo:1.3.1, docker push of both of those images to the same registry will do the lion’s share of the work only one time.