v12- fix(installer): add encryptionKey to utmstack_plugins.yaml for cloud …

[yllada]

Closes #2292

Summary

• The installer never wrote encryptionKey to the com.utmstack block in utmstack_plugins.yaml
• All cloud plugins (GCP, AWS, Azure, O365, Sophos, CrowdStrike, Bitdefender) read this key to decrypt tenant secrets at runtime
• Without it, decryption is silently skipped and the raw ciphertext is passed to the cloud SDK causing connection failures

Changes

File	Change
installer/docker/plugins.go	Added EncryptionKey field to PluginConfig struct and populated it with conf.InternalKey in the com.utmstack block

Test Plan

• Manually verified on v11-DEV-18: adding encryptionKey to utmstack_plugins.yaml resolved the GCP plugin failure immediately
• Confirmed backend and plugins use identical AES-CBC + PBKDF2(SHA1, 65536, 16) cipher — same key works for both encrypt and decrypt

[github-actions]

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Modification of installer configuration schema and hardcoded assignment of encryption keys.

• high installer/docker/plugins.go:24 — Adding EncryptionKey to the installer config schema is a breaking change for existing deployments and requires a migration/rollout plan.
• high installer/docker/plugins.go:86 — Hardcoding EncryptionKey to InternalKey is a security risk; secrets should be managed via vault or environment variables, not duplicated in config structs.

🛑 bugs (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Incorrect assignment of EncryptionKey and hardcoded internal IP address

• high installer/docker/plugins.go:86 — EncryptionKey is being assigned conf.InternalKey instead of conf.EncryptionKey, leading to incorrect configuration mapping.
• medium installer/docker/plugins.go:88 — Hardcoded internal IP address '10.21.199.3' detected in AgentManager configuration; this should be retrieved from configuration or environment variables.

🛑 security (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Hardcoded secret reuse and potential information disclosure of internal infrastructure IP.

• high installer/docker/plugins.go:86 — EncryptionKey is being assigned the value of InternalKey. Reusing internal authentication keys for data encryption is a cryptographic weakness. Ensure a unique, cryptographically secure key is generated for encryption.
• medium installer/docker/plugins.go:87 — Information disclosure: The hardcoded IP address '10.21.199.3' represents an internal infrastructure identifier. Remove internal network details from the codebase.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.