Overview

The encryptor manager mirrors keystore fields in its own members (e.g. _activeKEKID, _activeCMKList) under _keystoreMutex. These copies can drift from the store. Derive them from KeystoreSnapshot instead. Part of SERVER-136037.

Scope of Work

• Inventory every mirrored field in sls_log_encryptor_manager_impl.h and where it is updated.
• Replace each with a read from the current snapshot, or update it only from a committed snapshot.
• Keep _rotationsBlocked and rotation-status bookkeeping (not keystore state).

Acceptance Criteria

• No manager member duplicates a value stored in SLSKeystore, or every duplicate is refreshed only from a committed snapshot.
• Encryption unit tests and jstests pass.