CLD-538: route failed DNS-update messages to DLQ via partial-batch fa…

[nicktill-ibm]

Failed SQS records were being lost or causing duplicate NS1 POSTs. The handler returned batchItemFailures, but the event source mapping never had ReportBatchItemFailures enabled, so Lambda ignored it: soft failures (a returned messageId) were deleted as success, and uncaught exceptions failed the whole batch and re-POSTed already-synced records on retry forever, with no DLQ.

• template: enable ReportBatchItemFailures on the SQS event source; add a RedrivePolicy on CloudSyncUpdatesQueue (maxReceiveCount 5) targeting the existing DLQ; set VisibilityTimeout 60s and DLQ retention to 14 days; drop the unused EventInvokeConfig MaximumRetryAttempts (async-only).
• handler: wrap each record in try/except so one failure reports only its own messageId instead of failing the batch.
• tests: add unit coverage for the batch contract and record_handler outcomes, plus conftest import/region setup and missing test deps.