feat: add reliable batched HEC delivery

[alexb-splunk]

Summary

• send HecForwarder.forward_events() payloads as one concatenated HEC JSON request
• add opt-in blocking indexer acknowledgment with a persistent request channel and typed failures
• add BatchHecForwarder, a bounded in-memory queue with count/byte batching, timed and explicit flushing, backpressure, and fail-closed worker errors
• let HecHandler opt into the batch forwarder while preserving its synchronous default
• fix retry handling so a successful retry response is returned to the caller
• add context manager support and explicit lifecycle documentation

This is intended to produce the v1.1.0 feature release. It preserves the Python 3.9 floor and existing method signatures/default behavior.

The request and acknowledgment behavior follows the current Splunk documentation:

• HEC JSON event batching
• HEC endpoint and partial-batch response contract
• HEC indexer acknowledgment

Validation

• uv --no-config run --no-sync tox -e lint
• Python 3.9: 45 unit tests passed
• Python 3.14: 45 unit tests passed
• source distribution and wheel build passed
• local PEP 723 smoke harness syntax and lint checks passed

Live HEC smoke validation

The local PEP 723 smoke harness passed against an ephemeral Splunk instance:

• run ID d431ea2a-b514-4423-b756-4b8671602bd0
• 30 events across eight synchronous, batched, concurrent, handler-close, and acknowledgment cases
• standard HEC, indexer-acknowledgment HEC, and management API tokens verified
• exact SPL counts with no duplicate event IDs

Pre-handoff review

• simplification lane: approved
• spec-adherence re-review: approved
• correctness/reliability re-review: approved
• six findings resolved with regression coverage