A rotated KMS key policy omits the legacy alias and historical backup decrypt operations fail during recovery

New encrypt operations work, but restore testing fails because the recovery path still references an alias that the new policy no longer permits.