Apply SSE-KMS to damctl-built stores

Apply SSE-KMS to damctl-built stores damctl's build_store never applied the deployment CMK, so damctl backup and import transfer wrote objects with no KMS key at all -- silently bypassing G10-3 for the two paths that run outside damd/dam-worker. Split build_store/build_store_inner to apply with_sse_kms at the end, matching damd.