Creates a new customer-owned policy set whose first version reproduces the manifest of a source version: the source's latest non-archived version by default, or the one named by source_version_id. The set, any copied policies and their versions, the first policy set version, and its attestation are written in one transaction. Any failure leaves zero writes. The source is never modified.

Platform-owned sets (for example the zone default default-zone-policies) cannot be updated or versioned by customers. Clone is how a customer forks one into a set they can edit with PUT .../manifest.

copy_policies decides what is shared and what is duplicated (default platform):

• none: every entry pins the same policy version as the source. No new policies are created.
• platform: platform-owned pins are copied into new customer-owned policies; customer-owned pins are shared. The result is fully editable with minimal duplication.
• all: every pin is copied.

Copied policies get owner_type: customer, the source policy's description, and a first version whose cedar_json, schema_version and sha are copied verbatim from the pinned source version. There is no Cedar revalidation and no rewrite of the embedded static-policy keys; the evaluator namespaces them by policy version ID.

A copied policy is named after its source, with the platform catalog prefix default- stripped for platform-owned sources (default-user-grants becomes user-grants). Customer-owned names are kept as-is. A derived name that collides with a non-archived policy in the zone gets the first free numeric suffix (user-grants-2, user-grants-3, ...). Names are resolved inside the transaction; a concurrent race still surfaces as 409 policy_name_conflict.

Manifest order is the source's, with shared and copied pins interleaved as they were. schema_version is the source version's. target_type defaults to the source set's and may be overridden.

The ETag header is the digest of the first version's manifest, so clone, then conditional PUT .../manifest, needs no intermediate GET.

Domain error codes: policy_set_not_found, policy_set_version_not_found, policy_set_name_conflict, policy_name_conflict, set_archived, version_archived, schema_version_unsupported.