fix: make DLQ retry outcome-aware so failures stop reporting false success

[scotwells]

Problem

The dead-letter retry path reported success without ever re-processing events. It republished the raw bytes and counted the NATS-publish ACK as succeeded — it never re-ran CEL. So persistent policy-evaluation failures (e.g. generateName creates for Connector / Project / Domain) looked resolved in every metric and log, while the events bounced back into ingest, failed identically, reset their retry count, and were eventually suppressed by the dedup window. The user-visible activity timeline silently dropped those create events, and alerting self-cleared on arrival volume instead of firing on real loss.

What changed

• Retry worker is now outcome-aware. Before treating a retry as resolved, it re-runs audit policy evaluation in place using the existing EvaluateCompiledAuditRules path. Only events that actually pass evaluation get republished to generate an activity.
• Re-failures are tracked, not hidden. An event that fails re-evaluation is counted as a genuine failure and its retry count is advanced via updateAndRepublishMetadata (so it accumulates instead of resetting to 0), rather than being republished into the dedup window where it would be silently dropped.
• Honest metrics. The misleading dlq_retry_attempts_total{result="succeeded"} is split: evaluated-and-resolved = succeeded, put-back-without-observing = republished, and a new activity_processor_dlq_retry_failed_total{api_group,kind,policy_name,error_type} surfaces genuine persistent loss. The existing events_high_retry_total gauge now fires correctly because retry counts advance.
• Alert metric-name fix. ActivityGenerationStalled and ActivityProcessorHighErrorRate referenced activity_processor_audit_events_{received,errored}_total, which the code never registers — the alerts matched nothing. Repointed to activity_processor_events_{received,errored}_total{source="audit_log"}.
• Shared classifyEvaluationError helper across ingest and retry so error-type classification stays consistent.

Deferred / follow-up

• Production ActivityPolicy has() guards (the policy-side fix that stops the current bleeding) — those *-connector / *-project / *-domain policies are deployed as CRs outside this repo, so they aren't changed here.
• Terminal poison-pill / durable parked stream for events over AlertThreshold (needs new NATS stream infra that can't be safely validated in this change).
• Event-keyed KV ledger and full retry-latency histogram suite.

Testing

• go build ./..., go vet ./... clean.
• go test ./... passes (full suite), including internal/activityprocessor and internal/processor.
• Added unit tests for the new accounting: classifyEvaluationError table tests and reEvaluateDeadLetter outcome cases (unmarshal failure, no-policy-resolves).

Refs #208