fix(remote): grant the deploy role secretsmanager:PutSecretValue

remote/lib/llm-stack.ts

@@ -531,9 +531,16 @@ export class LlmStack extends cdk.Stack {
       }),
     );
     seedLaunchStatements().forEach((s) => deployFn.addToRolePolicy(s));
+    // CreateSecret/DescribeSecret mint the environment's key on first deploy;
+    // PutSecretValue rotates it when a deploy supplies a key, which
+    // invalidates the old value. All scoped to the per-environment secrets.
     deployFn.addToRolePolicy(
       new iam.PolicyStatement({
-        actions: ['secretsmanager:CreateSecret', 'secretsmanager:DescribeSecret'],
+        actions: [
+          'secretsmanager:CreateSecret',
+          'secretsmanager:DescribeSecret',
+          'secretsmanager:PutSecretValue',
+        ],
         resources: [envSecretArn],
       }),
     );

remote/test/stack.test.ts

@@ -172,6 +172,7 @@ describe('LlmStack (control plane)', () => {
       'ec2:AuthorizeSecurityGroupIngress',
       'ec2:RevokeSecurityGroupIngress',
       'secretsmanager:CreateSecret',
+      'secretsmanager:PutSecretValue',
     ]) {
       expect(actions).toContain(action);
     }