Creates or updates the rotation policy for a specific tenant.
This operation is idempotent - it will create if not exists, or update if exists.

Policy rules control algorithm transitions:
• requireOpsSubset: New key must support subset of original operations
• requireNoDowngrade: Prevent transitions to weaker algorithms
• allowClassicalToPqc: Allow RSA/EC → ML-KEM/ML-DSA transitions
• allowPqcToClassical: Allow reverse transitions (usually disabled)
• allowDifferentFamily: Allow ML-KEM → ML-DSA (different families)

Use cases:
• Enforce quantum-safe migration path
• Prevent algorithm downgrades
• Maintain compliance during transitions