[policy] Recurse extends: chain at install-time (follow-up to #827)