* fix(infra): run nightly snapshots as a stack-local DLM role (PLAT-77)
The lifecycle policy assumed a service-linked role AWS does not provide, so it stayed in ERROR and never snapshotted the data volume.
* fix(infra): scope DLM snapshot sharing to snapshot ARNs
ModifySnapshotAttribute on every resource can share a snapshot. The boundary allows it only on snapshot ARNs.