chore: use KMS-only SOPS encryption

[xnoto]

Summary

• add the Make IT Work Cloud SOPS AWS KMS key as the SOPS recipient
• remove the age recipient from .sops.yaml
• re-key secrets/secrets.yaml so SOPS metadata is KMS-only
• grant the caller workflow id-token: write for the shared workflow's GitHub OIDC role assumption

Dependency / rollout

• Requires makeitworkcloud/tfroot-aws#6 and makeitworkcloud/shared-workflows#7, both now merged/applied.

Validation

• AWS_PROFILE=makeitwork sops decrypt --output /dev/null secrets/secrets.yaml
• verified SOPS metadata has kms=1 and age=0
• PCT_TFPATH=$(command -v tofu) pre-commit run --all-files

[github-actions]

OpenTofu Plan

OpenTofu will perform the following actions:

  # module.k3s.libvirt_cloudinit_disk.commoninit will be created
  + resource "libvirt_cloudinit_disk" "commoninit" {
      + id             = (known after apply)
      + meta_data      = <<-EOT
            instance-id: k3s
            local-hostname: k3s
        EOT
      + name           = "k3s_commoninit"
      + network_config = <<-EOT
            version: 2
            ethernets:
              enp1s0:
                dhcp4: true
              enp2s0:
                dhcp4: false
                addresses:
                  - 192.168.102.2/24
        EOT
      + path           = (known after apply)
      + size           = (known after apply)
      + user_data      = (sensitive value)
    }

  # module.runner.libvirt_cloudinit_disk.commoninit will be created
  + resource "libvirt_cloudinit_disk" "commoninit" {
      + id             = (known after apply)
      + meta_data      = <<-EOT
            instance-id: runner
            local-hostname: runner
        EOT
      + name           = "runner_commoninit"
      + network_config = (sensitive value)
      + path           = (known after apply)
      + size           = (known after apply)
      + user_data      = (sensitive value)
    }

Plan: 2 to add, 0 to change, 0 to destroy.