* security(kms): require explicit dev defaults opt-in * test(kms): satisfy clippy dev defaults checks