[codex] Clarify AWS Batch KMS requirements

[llewellyn-sl]

Summary

• clarify the AWS Batch docs for accounts that enforce customer-managed default EBS encryption
• document the required KMS permissions on the EC2 instance role and the Auto Scaling service-linked role dependency in the KMS key policy
• keep the update scoped to the existing platform-cloud AWS Batch setup pages instead of creating a new troubleshooting page

Source

• Slack nightly summary: https://seqera.slack.com/archives/C0APYR2A3A8/p1775081447163959
• EDU ticket: https://seqera.atlassian.net/browse/EDU-1105

Doc target

• platform-cloud → platform-cloud/docs/compute-envs/aws-batch.md
• platform-cloud → platform-cloud/docs/enterprise/advanced-topics/manual-aws-batch-setup.mdx

Rationale

The ticket points to a recurring setup failure where AWS Batch instances remain stuck because the docs mention encryption broadly but do not spell out the customer-managed KMS key requirements for default EBS encryption. These edits add the missing guidance exactly where operators configure the instance role and Batch environment.

Validation

• File-level validation confirming the new KMS guidance is present in both pages
• Full Docusaurus build not run in this environment because node_modules are not available in the automation clone

Follow-up questions / gaps

• If this issue keeps recurring, the next step would be a dedicated troubleshooting section for common AWS Batch instance launch failures, but this draft keeps the change minimal and directly actionable.

[netlify]

❌ Deploy Preview for seqera-docs failed. Why did it fail? →

Name	Link
🔨 Latest commit	28f42d7
🔍 Latest deploy log	https://app.netlify.com/projects/seqera-docs/deploys/69d7c87f2d0483000846ab96

[justinegeffen]

@llewellyn-sl, does this PR output include the details from Drew's comment in the Jira issue?