Add Bounded Backpressure and Durable Spillover for `output_hlquery`

[cferrys]

Summary

output_hlquery currently uses an unbounded in-memory async queue. During hlquery downtime, network stalls, or ingestion bursts, hlog can keep tailing files and enqueueing events faster than the worker can post them, risking unbounded memory growth and delayed failure-buffer writes.

Context

hlog is positioned as a high-performance feeder for hlquery, so its failure behavior under downstream pressure is part of the core reliability contract. In src/core/pipeline.cpp, Pipeline::AsyncHlqueryOutput::Enqueue() always appends to Queue, while the worker only records failed lines to FailureRecorder after dequeuing and attempting delivery. This means the failure buffer does not protect the process while the queue is growing.

The recent configure/runtime-config work makes hlog easier to operate, and the runtime config already exposes batch_lines, batch_interval, timeout, and failure_buffer. The missing piece is a bounded delivery policy that makes these controls safe under sustained load.

Proposed Implementation

Add configurable output queue limits and spillover behavior for output_hlquery:

1. Introduce config attributes such as queue_max_events, queue_max_bytes, and queue_full_policy.
2. Support policies:
   • block: pause ingestion until queue capacity is available.
   • spill: append overflow events directly to the failure buffer.
   • drop_oldest or drop_newest: only if explicitly configured, with critical logging.
3. Track queue depth, approximate queued bytes, spill count, dropped count, and successful post count.
4. Emit sparse operational logs when queue pressure begins, clears, spills, or drops.
5. Ensure shutdown drains or spills remaining queued events deterministically.
6. Add focused tests for:
   • queue limit enforcement;
   • spill-to-failure-buffer behavior;
   • shutdown with pending events;
   • batch mode interaction with queue limits.

Impact

This turns output_hlquery from best-effort async posting into an operator-safe ingestion stage. It protects hlog from memory exhaustion, makes downstream outages recoverable, and gives users predictable behavior during bursty log volume while preserving high-throughput batching for normal operation.