A new KMS grant allows the backup role to decrypt snapshots, but the grant was created in one region and cross-region restore still fails

The permission exists, just not in the control-plane scope the recovery workflow actually uses.