fix(knowledge-base): grant scoped decrypt for S3 KMS keys

[proton0210]

Description

S3 knowledge-base sources can now specify kmsKeyArn in agentcore.json. The generated stack grants the KB service role kms:Decrypt on that key, restricted to S3 in the key's region. Sources without a key do not receive KMS permissions.

The generated CDK entry point validates and retains the key separately before passing the project to the published L3 schema, which does not yet accept this field. This works with the current package pin. Existing projects need the updated generated CDK files; the documentation calls out that update and includes a configuration example.

Related Issue

Fixes #2440

Documentation PR

Documentation is included in this PR.

Type of Change

• Bug fix

Testing

• I ran npm run test:unit and npm run test:integ.
• I ran npm run typecheck.
• I ran npm run lint.
• I updated and verified the asset snapshots.

The full integration run passes 355 tests, with one skipped. The full unit run passes 6,359 tests; one unrelated CreateScreen Escape timing test fails in the parallel run and passes when rerun alone. Type checking and lint report no errors.

The generated CDK project builds and passes all 17 tests, including policy synthesis for AWS, China, and GovCloud, malformed key rejection, connector validation, and unencrypted sources. The focused schema and asset suites pass all 181 tests.

Against the previous implementation, three schema cases and four IAM assertions fail. The original generated entry point rejects kmsKeyArn; the updated entry point synthesizes a stack with the scoped decrypt statement.

Checklist

• I have read the CONTRIBUTING document.
• I have added tests that prove the fix is effective.
• I have updated the documentation and included an example.
• My changes generate no new warnings.
• No dependent package release is required.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.