fix(remote): grant the deploy role secretsmanager:PutSecretValue

[outofcoffee]

Key rotation deploys fail: the deploy role lacks the action 1.31.0's rotation path needs.

Summary

• remote deploy --api-key-env (1.31.0) rotates an existing environment's key secret via secretsmanager:PutSecretValue, but the deploy Lambda's role was only ever granted the create-path actions (CreateSecret, DescribeSecret) — so a rotation deploy dies with an IAM denial wrapped as HTTP 502.
• Add secretsmanager:PutSecretValue to the deploy role's grant, scoped to the same per-environment cloud-vm-llm/* secret prefix, with the stack test asserting it.

Implementation details

• The 1.31.0 Lambda code already calls the action — this is purely the missing policy line. Applying it is a plain remote bootstrap re-run: an idempotent stack update that changes only the role's policy (no AMI bake, no reseed, no environment redeploy).