fix(termination-watcher): preserve env vars and KMS access

[edersonbrilhante]

Description

• Preserve caller-provided termination-watcher environment variables instead of replacing them in the parent configuration.
• Keep generated metric and tag-filter variables scoped to the Lambda components that own them.
• Add optional ssm_kms_key_id support and grant kms:Decrypt to the notification, termination-handler, and deregistration-retry Lambda roles.
• Wire the existing root and multi-runner kms_key_arn inputs to the termination watcher.
• Keep the IAM policy shape plan-safe when the key ARN is null or unknown by using an inert fallback ARN.

The runtime already requests decrypted SSM values, so no Lambda source change is required.

Test Plan

• Added Terraform behavior coverage for caller environment variables, component-owned variables, configured KMS access, and the null-key policy shape: 2 passed, 0 failed.
• Ran terraform validate for the root module, modules/multi-runner, and modules/termination-watcher.
• Ran TFLint for modules/termination-watcher.
• Ran Terraform formatting and git diff --check for the affected files.

Related Issues

• Required before feat(multi-runner): add experimental EC2 provider stack #5251 can re-enable its experimental termination-watcher KMS and environment-variable integration.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None