From the design:

Aggregate commands are parsed into a LiteParsedPipeline and then are only parsed into a full pipeline if the pipeline is not passed through to the primary shard, which only happens in certain conditions. We can add another condition so that aggregate commands won't be passed through to the primary shard if there may be FLE2 rewrites that need to be done, so that $match rewrites will happen on mongos before the pipeline is sent along to the relevant shards by the AggregationTargeter.

Stage rewrites

We can add a transformation pass right after the pipeline is parsed that is only run if there may be FLE2 rewrites to be done that will iterate through the stages in the pipeline and call rewriteQueryOnEncryptedFields() with the MatchExpression held by the relevant stage.