Retries the first scan of an org connection's inventory (the retry affordance on a failed connection). Requires manage rights on the organization. Uses the opt-in-independent first-scan path the connect and grant-change paths use, so an auto-provisioned inventory that never opted into automatic scanning can still be re-scanned. The deterministic workflow id dedupes: retrying twice never stacks two scans — a second retry while one is running returns 409 (rescan_in_flight). Returns 404 when the connection has no provisioned inventory to re-scan.