docs(dlq): help on-call find what's failing when a DLQ alert fires

[scotwells]

What this does

When a Dead Letter Queue alert fires, whoever's on call needs to find which activity policy is failing, and why — quickly. Today the runbooks send them to a quick command that only shows the last few minutes of logs from whichever pods happen to be running right now. The failures that set off these alerts are usually older than that, so the most useful clues are often already gone — and there was no guidance on how to search our log history instead.

This gives on-call a clear, copy-paste path to the right logs, so they can go from "an alert fired" to "this specific policy is broken on this field" in a couple of steps.

What changed

• A new short guide that walks through, per DLQ alert, exactly what to look for and how to find it in Grafana — including how to tell a genuine backlog apart from the same few events looping, and a couple of gotchas that have caught people out before.
• Each DLQ runbook now points to that guide and shows the right query for its alert, replacing the old "tail the logs and grep" step that misses older failures.

Documentation only — no behavior changes.

Related

Part of the larger effort to fix the DLQ failures that were silently dropping activities — and to make them easy to see and triage:

• DLQ retry reports false success and silently drops failed events (no real queue-failure tracking) #208 · fix: make DLQ retry outcome-aware so failures stop reporting false success #209 — the processor now tracks DLQ failures truthfully (retries actually re-evaluate the event instead of quietly re-queueing the same broken one).
• The policy fixes that stopped the dead-lettering at the source: fix: show newly created networking resources in the activity feed datum-cloud/network-services-operator#223, fix: show newly created projects and resources in the activity feed milo#668, fix: show new billing accounts in the activity feed billing#67, fix: show DNS record changes in the activity feed datum-cloud/dns-operator#50.