Replaces the expanded scope set of a system role (is_system=true).
Body shape: { "scopes": [...] }. Jackson rejects unknown properties.

Required scope: admin.platform.role.update.
Required JWT tenantId: ROOT_TENANT_ID (defense-in-depth).

Cache invalidation: on commit, publishes to the role-scope Pub/Sub
channel. Effective on NEXT JWT issuance — active JWTs retain their
original scope set until expiration (architect Slice 5 P0
authorization rollback semantics).