Hey David,
Your intuition is correct. All traffic goes through Render’s Cloudflare zone, so the header will be stripped regardless of whether caching is enabled. You can achieve the same functionality using the Cache API with a Cloudflare worker.
You can set the X-Cache-Tag response header in your Render service. In the worker, you can then set Cache-Tag to the value of X-Cache-Tag immediately after (or in place of) response.headers.append('Cache-Control', 's-maxage=10'); so that it is present when you call event.waitUntil(cache.put(cacheKey, response.clone()));.
This should achieve the same functionality that you would expect by setting Cache-Tag.