RegenerateCookieBannerTrackerPolicy authorized against the generic cookie-banner update action, conflating policy regeneration with banner edits. Add a dedicated regenerate-policy action and authorize both the console and MCP resolvers against it so the capability can be granted independently. Signed-off-by: Émile Ré <emile@probo.com>