Fix prod canary and status-updater KMS decrypt

Defect (risk register `docs/compliance/risk-register.md:116`, R-SOC-28): prod internal availability is unmonitored. Since 2026-10-09 ~15:00Z the `main-console` Synthetics canary (`infra/jaah/terraform/monitoring.tf:765`) and the `jaah-main-status-updater` Lambda (`infra/jaah/terraform/status-page.tf:369`) fail with `kms:Decrypt` denied: the workload permissions boundary statement `KeysOnlyOwnDirect` (`infra/jaah/terraform/modules/deploy-policy/main.tf:236-241`) denies direct decrypt of any key not tagged `Environment=<env>`, and both functions' environment variables are encrypted with the untagged AWS-managed `aws/lambda` key. Observed by Task 5358's live check on 2026-10-09: `cloudwatch describe-alarms` showed 2 ALARM rows from this cause (readiness-checklist CC7.2 row). A Lambda-context exemption does not fit the 6,144-char boundary limit (measured 6,354). Fix: give both functions a customer-managed KMS key tagged `Environment=<env>` (one key, key policy allowing the two execution roles + Lambda service), set `kms_key_arn` on the status-updater Lambda and the canary's run_config/Lambda environment encryption. Do NOT widen the boundary. Out of scope: any other boundary statement; other alarms; the alarm relay; promotion to master (that is the owner's Owner-actions H-1 style act — add this PR to the promotion row in `docs/compliance/readiness-checklist.md` § Owner actions). Done means: - `terraform plan` for dev shows the new key + `kms_key_arn` on both functions and no boundary change (cite plan output). - After dev deploy: dev canary's latest run PASSED and `aws lambda invoke` of the dev status-updater returns no KMS error (cite). - `infra/jaah` terraform tests + `./dc check full` green; PR merged to develop; Jaah Deploy green. - R-SOC-28 row updated to "fixed on develop, live after promotion" and the promotion row names this PR.

R-SOC-28 fixed on develop (PR #4791 merged, full gate + Jaah Deploy green), boundary untouched: status updater on its own env-tagged KMS key; canary env-free (Synthetics takes no key) as main-console-vpc. Dev proof FAILED→PASSED. Live after H-1 promotion; delete orphan cwsyn-main-console Lambda.