Writes the policy row for scope.

Every axis is optional, and null clears that axis, letting it fall
through to the next resolution tier (and to unlimited if no tier sets
it). An explicitly stored 0 is a real cap meaning "block everything",
which is distinct from null. The write replaces the whole row, so an
omitted axis is cleared rather than preserved.

perRunCostUsd is rejected on the node scope: a per-run ceiling is a
property of a single run, not a node-wide aggregate, so accepting it
there would store a value that never applies.

Permissions: Node owner or workspace administrator — for every
scope, including a user's own. A user raising their own cap would defeat
the purpose of having one.