Summary

Cookies(<Cookies>) built a new jar with the default policy, dropping the original one. Since #1284 the client only copies its cookies when per-request cookies= are passed, so on that path a policy like blocked_domains on the client jar was ignored and blocked cookies were sent.

Checklist

• I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.

AI Disclaimer

This PR was developed with the assistance of either Claude or Codex. I've reviewed and verified the changes.