chore: use KMS-only SOPS encryption

[xnoto]

Summary

• add the Make IT Work Cloud SOPS AWS KMS key as the SOPS recipient
• remove the age recipient from .sops.yaml
• re-key secrets/secrets.yaml so SOPS metadata is KMS-only
• grant the caller workflow id-token: write for the shared workflow's GitHub OIDC role assumption
• stop passing SOPS_AGE_KEY to the shared workflow

Dependency / rollout

• Requires makeitworkcloud/tfroot-aws#6 and makeitworkcloud/shared-workflows#7, both now merged/applied.
• makeitworkcloud/shared-workflows#8 removes the age secret from the reusable workflow itself.

Validation

• AWS_PROFILE=makeitwork sops decrypt --output /dev/null secrets/secrets.yaml
• verified SOPS metadata has kms=1 and age=0
• PCT_TFPATH=$(command -v tofu) pre-commit run --all-files

[github-actions]

OpenTofu Plan

No changes. Your infrastructure matches the configuration.

OpenTofu has compared your real infrastructure against your configuration and