Apply a policy preset

Applies through the agent update handler, not by writing guardrail columns. A preset that wrote them directly would be a way around the guardrail widening approval flow wearing a friendlier interface.

So if the preset loosens something and your organisation gates that, you get the same 202 with a pending approval you would get from editing the agent by hand — not a quietly applied change. Pass approval_id once that approval is granted.