Track filtered-out events in enrichment failures table

Problem

Currently, events that are filtered out during enrichment (missing identifiers) are only logged with a warning. They don't appear in the enrichment_failures table, making it difficult to track why they weren't enriched or to reprocess them later.

This makes it hard to analyze and recover from enrichment failures comprehensively.

Solution

Add filtered-out events to the enrichment_failures table with a categorized reason for why they were filtered out:

• missing_all_identifiers - No namespace ID, instance ID, or subject
• missing_namespace_identifiers - SaaS event missing namespace IDs
• missing_instance_identifier - Self-managed event missing instance ID
• unknown - Other reasons

This gives visibility into all events that didn't get enriched, whether they failed during enrichment or were filtered out before enrichment was attempted.

Related

• #16125 - Duo AI Cost Allocation: Absorbed Unenriched Events