Advanced AWS EKS Bottlerocket Node Security Hardening

Act as a Kubernetes DevSecOps Engineer. Formulate an uncompromising, military-grade migration strategy to transition AWS EKS managed worker nodes from vulnerable generic Linux images to the highly secure, container-optimized Bottlerocket OS. Provide the Terraform HCL defining an `aws_eks_node_group` pinned to [CLUSTER_VERSION] utilizing the `BOTTLEROCKET_x86_64` AMI type. Enforce that both the root and data EBS volumes are cryptographically secured using the [KMS_ENCRYPTION_KEY]. Configure the underlying Bottlerocket TOML user-data settings to reflect the strict [ADMIN_CONTAINER_CONFIG], ensuring the admin container is disabled by default and requires SSM Session Manager for break-glass emergency access. Provide a heavily documented `kubectl cordon` and `drain` workflow to cycle the nodes without dropping active client connections.