Set the delegated verification-enforcement policy (master/solo)

Enable/disable delegated enforcement for a tenant/sub-key. master/solo only — a child key can never enable itself → 403 FORBIDDEN_CHILD_KEY (the delegation is exercised by the platform operator).

Body { enabled, mode?, target? }. Without target: a master defaults to scope=organization, a solo to scope=user. scope=api_key requires target.api_key_id belonging to the caller's organization (else 404 anti-enumeration). Each change bumps version and is written to the firm audit log.

When active, a blocked output returns 422 OUTPUT_WITHHELD_BY_POLICY (type policy_error) with no charge (no debit, or refund), the failed citations, and a signed attestation.