Overview

Make CMK rotation and CMK oplog apply atomic. This is the path with the lost-update and rollback-clobber bugs. Part of SERVER-136037.

Scope of Work

• _rotateCMKInBackgroundImpl: take the snapshot before _reEncryptAllKEKsWithNewCMKList, so a KEK added during KMIP work causes a conflict instead of being overwritten.
• _writeCMKEntry: replace setCMKList + setActiveCMKListId + updateAll + pushToWT with one commitAndPush; remove the setKeystore(snapshot) restore; build the kCMKRotation oplog entry from the committed snapshot (not a fresh getKeystore).
• On conflict the rotation fails, its CMK list ID is burned (as for any failed rotation today), and status is reported via getESECMKIdentifierListStatus.
• insertCMKFromOplog: same bounded retry / skip-if-applied policy as ticket 4.
• initializeForFreshCluster / _emitFreshClusterCMKOplogEntry: set the initial CMK list on the committed copy.

Acceptance Criteria

• CMK paths no longer call setCMKList, setActiveCMKListId, updateAll, setKeystore or standalone pushToWT.
• Enable the lost-update, torn-push and rollback-clobber tests from ticket 1.
• Existing tests pass, including cmk_rotation_with_writes.js and the cmk_rotation_* jstests.