Overview

Replace put / pushToWT / pop in the KEK paths with snapshot -> modify copy -> commitAndPush. Part of SERVER-136037.

Scope of Work

• _writeKEKEntry (primary KEK rotation): build next with the new KEK document and active KEK ID; keep caching the decrypted KEK before the push; write the km oplog entry from the committed snapshot.
• insertKeyFromOplog (standby apply): on KeystoreConflict, re-snapshot, skip if the KEK is already present (a concurrent loadFromWT installed it), otherwise retry up to a fixed limit.
• KEK rotation fails cleanly on conflict and reports through getESERotateActiveKEKStatus.
• Keep crash-on-divergence after a successful push (SERVER-128936) and _rotationsBlocked.

Acceptance Criteria

• KEK paths no longer call put, pop, setActiveKEKId or standalone pushToWT.
• Enable the KEK-related tests from ticket 1.
• Existing tests pass, including kek_rotation_concurrency.js and key_rotation_across_stepdown.js.

Technical Notes

• Same file as ticket 5 (sls_log_encryptor_manager_impl.cpp): land 4 and 5 in sequence, not in parallel.