Apply a Policy Bundle for the calling user

Accepts an edited Policy Bundle archive and applies it as the active user-scope PolicySetVersion for the calling user.

The user's policy set is seeded from the system-default policies on first access, forked into customer-owned policies; a user bundle therefore contains only customer-owned policies. Applying an edit creates a new version of the affected policy, and a new_policy entry adds a further customer-owned policy. Platform-owned catalog policies are never edited in place by this operation.

The request body codec is determined from Content-Type. The only codec supported today is application/vnd.keycard.policy-bundle.v1+tar+gzip.

Supports optimistic concurrency via If-Match: when supplied, the server applies the bundle only if the supplied ETag matches the current bundle ETag; otherwise responds 412 Precondition Failed.

On success the server returns the materialized bundle (in the same codec) and its new ETag.