Add --kms-key-arn flag to add gateway

## Summary
The AWS API `CreateGateway` accepts a `kmsKeyArn` parameter for encrypting gateway configuration at rest, but the CLI's `add gateway` command does not expose it.

## Evidence
- **AWS:** [`CreateGateway.kmsKeyArn`](https://docs.aws.amazon.com/bedrock-agentcore-control/latest/APIReference/API_CreateGateway.html) — "The ARN of the AWS KMS key used to encrypt data associated with the gateway."
- **CLI:** `AgentCoreGatewaySchema` (`src/schema/schemas/mcp.ts:1065`) has no KMS field; no flag in `GatewayPrimitive.ts`.

## Proposal
Add an optional `--kms-key-arn ` flag (no default) to `add gateway`, wire it to the schema and CDK gateway construct. Matches the existing pattern on `add dataset`, `add evaluator`, `add policy-engine`.

Start with AgentCoreGatewaySchema in src/schema/schemas/mcp.ts:1065 and the add gateway entry point in GatewayPrimitive.ts. Compare the existing KMS flag patterns on add dataset, add evaluator, and add policy-engine, then trace the gateway construct wiring. Done means an optional --kms-key-arn value is accepted by add gateway and reaches the CDK gateway construct without a default.

Written by the indexing model from the issue text.