fix(roles): guard built-in Datadog roles from create and update

[michael-richey]

Summary

The 3 built-in Datadog roles (Datadog Admin Role, Datadog Read Only Role, Datadog Standard Role) cannot be created, updated, or deleted via the API. Previously only delete_resource raised SkipResource for these names; create_resource and update_resource would still attempt the request and fail (the existing managed attribute check only short-circuited when the destination role happened to carry it).

This PR adds name-based BUILTIN_ROLE_NAMES guards across all three CRUD paths in datadog_sync/model/roles.py:

• delete_resource — unchanged; existing guard still raises SkipResource.
• update_resource — raises SkipResource at the top. Safe because the handler only invokes update when state mapping already exists (see resources_handler.py:247), so skipping preserves the existing mapping.
• create_resource — does not unconditionally skip. Built-in roles always exist at the destination, and dependent resources (users, restriction policies, authn mappings, etc.) resolve role IDs via state.destination["roles"][source_id]. Skipping outright would break those dependents. Instead:
  • Raise SkipResource only if the built-in is somehow not present at the destination (defensive).
  • Otherwise fall through to the existing "role already exists at destination" branch and short-circuit before the diff/update logic, returning the destination role data so the wrapper records the mapping into state without making any API call.

Test plan

• tox -e ruff,black clean
• tox -e py313 -- tests/unit/test_roles.py — 14/14 pass
• Full unit suite — 569/569 pass (no regressions)
• Integration cassettes for test_roles contain zero POST/PATCH/DELETE; the two update-related integration tests are already @pytest.mark.skip (RBAC disabled in test org), so no integration impact
• New unit test test_create_maps_existing_builtin_role_without_api_call exercises the load-bearing case: state mapping is recorded via _create_resource, post/patch never awaited
• Green/green coverage: non-built-in roles still create/update/delete normally

🤖 Generated with Claude Code