Switch the exec-aide table from the AWS-owned key to the shared
customer-managed CMK (alias/seahaven-dynamodb, imported via SSM
/seahaven/dynamodb/cmk-arn). In-place UpdateTable, no replacement.
CDK auto-grants kms to the 5 in-stack consumer roles (4 pipeline
Lambdas + SocketMode Fargate task role). Deployed + verified:
SSEType=KMS, scan decrypts, ECS service healthy.
INFRA-95