Policy test cleanup intermittently fails with `KQLSyntaxError` when deleting package policies

## Summary

Policy tests intermittently fail during **cleanup** when deleting a package policy that has `secret_references`. `elastic-package` gets a `400 Bad Request` from Kibana with a `KQLSyntaxError`, which fails the test and (historically) cascaded into other policy tests failing.

This was previously seen in elastic/integrations#16136 and partially mitigated by elastic/elastic-package#3118 — but **that PR fixed a different root cause** (agent/package policy *name collisions*). The failure below is a distinct problem and is still happening.

Recent recurrences:
- elastic/integrations#20054 — `cloudflare_logpush.email_security_alerts`, `test-aws-s3.yml`
- elastic/integrations#20055 — `cloudflare_logpush.gateway_http`, `test-aws-s3.yml`
- First build: https://buildkite.com/elastic/integrations/builds/45770

Context: elastic/integrations#16136, PR elastic/elastic-package#3118.

## Error

```
cleanup failed: there was an apply error: could not delete policy "test-aws-s3-76673":
could not delete policy; API status code = 400; response body =
{"statusCode":400,"error":"Bad Request","message":"KQLSyntaxError: Expected \")\" but \"N\" found.
ingest-package-policies.attributes.secret_references.id: (Wf85RZ8Bg9k13wUkANoR or W_85RZ8Bg9k13wUkANoT or Wv85RZ8Bg9k13wUkANoR)
---------------------------------------------------------------------------------------------------^: Bad Request"}
```

Start with the policy-test cleanup path that deletes package policies containing secret_references, using the KQLSyntaxError and recent cloudflare_logpush or test-aws-s3.yml recurrences as reproduction context. Trace the delete request and distinguish this failure from the name-collision fix in elastic-package#3118; done means cleanup succeeds without the 400 error or cascading policy-test failures.

Written by the indexing model from the issue text.