feat(aws-transform): sync Kiro Power from ATXKiroPower (post cli-3.3.0)

Promote ATXKiroPower/mainline continuous-modernization steering updates
merged since the cli-3.3.0 tag (EC2/Batch execution, scheduling,
remediation, source handling).

Bump POWER.md version 2.1.2 -> 2.2.0 (minor; feature release).

Author: jdonboch

aws-transform/POWER.md

@@ -4,7 +4,7 @@ displayName: "AWS Transform"
 description: "Migrate, modernize, and upgrade codebases: .NET Framework to .NET 8/10, mainframe COBOL to Java, VMware VMs to EC2, SQL Server/Oracle/MySQL to Aurora, and Java/Python/Node.js version upgrades or AWS SDK migrations. Assess, plan, and execute code transformations from your IDE."
 keywords: ["migrate", "modernize", "mainframe", "cobol", "vmware", "dotnet", ".net framework", "windows", "sql server", "oracle", "mysql", "aurora", "ec2 migration", "rehost", "lift-and-shift", "replatform", "legacy", "code upgrade", "sdk migration", "boto3", "java upgrade", "atx", "continuous modernization", "AWS Transform - continuous modernization"]
 author: "AWS"
-version: "2.1.2"
+version: "2.2.0"
 ---
 
 # AWS Transform Power

aws-transform/steering/workload-continuous-modernization-batch-execution.md

@@ -270,7 +270,7 @@ Show the list to the customer and ask:
 3. **Repos to analyze:** all repos in source, or a specific subset
 4. **Analysis type:** `tech-debt-comprehensive`, `tech-debt-quick`, `security`, `agentic-readiness`, `modernization-readiness`
 
-If the list is empty or the customer wants to register a new source first, run `atx ct source add` via the [continuous-modernization-source](workload-continuous-modernization-source.md) skill, then return here.
+If the list is empty, the customer wants to register a new source, or needs to update the token on an existing source, use the [continuous-modernization-source](workload-continuous-modernization-source.md) skill (`source add` for new, `source update` for existing), then return here.
 
 Once the source is selected, run discovery and enumerate:
 
@@ -360,6 +360,13 @@ read -s TOKEN && { aws secretsmanager create-secret --name "<secret-name>" \
        --secret-string "$TOKEN" --region <region>; }; unset TOKEN
 ```
 
+- If the secret exists → ask the customer: "Your `<secret-name>` token was last updated on `<LastChangedDate>`. Would you like to rotate it, or is the current token still valid?" If they want to rotate:
+
+```bash
+read -s TOKEN && aws secretsmanager put-secret-value --secret-id "<secret-name>" \
+  --secret-string "$TOKEN" --region <region>; unset TOKEN
+```
+
 **Step B — Confirm SCM configuration with user (MANDATORY for non-local providers):**
 
 Before submitting any batch job (analysis or remediation), ask the user to confirm the SCM provider config that will be injected into the container. An incorrect identifier, email, or username causes clone failures inside the container after the setup phase.