Summary

Separate Datadog sink configuration validation from runtime construction.

In restricted environments such as CI, containers, and AI coding-agent sandboxes,
vector validate --no-environment is expected to validate structural configuration
without opening outbound connections or initializing runtime resources such as native
TLS trust stores.

Previously, Datadog sink validation could reach runtime client/TLS construction even
when no outbound request was made. In restricted sandbox environments, the macOS
Keychain may be unavailable; attempting to load native root certificates through it
caused validation to panic.

This PR makes the boundary explicit:

• Move configuration-only validation for the Datadog logs, metrics, events, and
  traces sinks into ValidatedSink::validate.
• Keep client, proxy, TLS, global Datadog option, and effective endpoint construction
  in the runtime build path.
• Move the APM stats flusher from a build-time detached task into the
  TracesSink::run lifecycle.
  • Request a final flush after both successful and failed trace drivers.
  • Bound shutdown acknowledgement waiting to 10 seconds so a stuck endpoint cannot
    delay shutdown indefinitely.
• Avoid unnecessary native certificate-store initialization when certificate
  verification is disabled.
• Consolidate shared Datadog endpoint, TLS, and client construction logic to reduce
  sink-specific validation/build drift.

Regular vector validate continues to build all sinks and remains the validation
mode for errors that require effective runtime construction. --no-environment
intentionally does not guarantee detection of every runtime construction error.

The APM flusher acknowledgement confirms that the final flush was attempted; it does
not guarantee that Datadog accepted the payload.

References

N/A

Vector configuration

No new user configuration was added. Unit tests cover the Datadog logs, metrics,
events, and traces sinks with their existing inline configurations and custom
endpoints.

How did you test this PR?

• cargo test -p vector --lib datadog
• cargo test -p vector-core tls::settings::test
• cargo test -p vector --lib sinks::datadog::traces::sink::tests
• cargo check -p vector --lib
• make check-clippy
• cargo fmt --all -- --check
• make check-changelog-fragments

Is this a breaking change?

• Yes
• No

Does this PR include user facing changes?

• Yes. A changelog fragment will be added in a follow-up commit after the PR number is assigned.
• No. A maintainer will apply the no-changelog label to this PR.