feat(import): capture encryptionKeyArn during memory import

Add encryptionKeyArn to CLI schema, MemoryDetail, and toMemorySpec so
imported memories preserve their KMS encryption key configuration.
Also update CDK L3 construct to pass encryptionKeyArn through to CfnMemory.

Author: jesseturner21

src/cli/aws/agentcore-control.ts

@@ -260,6 +260,7 @@ export interface MemoryDetail {
     reflectionNamespaces?: string[];
   }[];
   tags?: Record<string, string>;
+  encryptionKeyArn?: string;
 }
 
 /**
@@ -314,6 +315,7 @@ export async function getMemoryDetail(options: GetMemoryOptions): Promise<Memory
     description: memory.description,
     eventExpiryDuration: memory.eventExpiryDuration,
     tags,
+    encryptionKeyArn: memory.encryptionKeyArn,
     strategies: (memory.strategies ?? []).map(s => {
       if (!s.type) {
         throw new Error(`Memory ${options.memoryId} has a strategy with missing required field: type`);

src/cli/commands/import/import-memory.ts

@@ -67,6 +67,7 @@ function toMemorySpec(memory: MemoryDetail, localName: string): Memory {
     eventExpiryDuration: Math.max(7, Math.min(365, memory.eventExpiryDuration)),
     strategies,
     ...(memory.tags && Object.keys(memory.tags).length > 0 && { tags: memory.tags }),
+    ...(memory.encryptionKeyArn && { encryptionKeyArn: memory.encryptionKeyArn }),
   };
 }
 

src/schema/schemas/agentcore-project.ts

@@ -103,6 +103,7 @@ export const MemorySchema = z.object({
       )
     ),
   tags: TagsSchema.optional(),
+  encryptionKeyArn: z.string().optional(),
 });
 
 export type Memory = z.infer<typeof MemorySchema>;