test: recover live + unit coverage stranded on merged parity branch

[neo-lyzr]

Summary

Recovers the test additions from #3 that never reached main. #3 was merged into the parity branch feat/parity-catchup-py-v0.2.5, but #1 had already merged that branch to main before #3 landed — so the email/sql live tests and unit-rigor fixes ended up stranded on the parity branch.

This is a clean cherry-pick of the #3 test commit (e93169f) onto main — tests only, no src//package.json changes.

Restores:

• New live tests: tests/live/email.live.test.ts, tests/live/sql.live.test.ts
• Extended live tests: aws (SQS FIFO/DLQ/depth/nack), azure (SB sessions), cache (scan/getdel/expire NX-XX/decodeResponses)
• Extended tests/live/env.ts gating (SES, RDS PG/MySQL +IAM, Redshift, FIFO/DLQ, Azure sessions)
• Unit-rigor fixes: rewrote the tautological MSSQL pooling test, added SQL/email error-mapping + FileSecretBackend atomic-write tests

Validation

• Unit lane: green (now includes the recovered unit tests).
• Live lane without creds: all skip (every block describe.skipIf-gated).
• Tests-only; no runtime/source/manifest changes.

[neo-lyzr]

Live-validated against a real AWS account

Ran the live lane (CLOUDRIFT_LIVE_TESTS=1) against a real AWS account in us-east-1 using short-lived SSO credentials. All resources are uniquely-named cloudrift-live-*, created-then-deleted by the suite; verified zero orphaned resources before and after (S3/SQS/SNS/Secrets all empty). No existing infrastructure (ECS, etc.) is ever touched.

Passing live lifecycles:

• S3: upload → exists → download → list → delete
• SQS: send → long-poll receive → ack → healthCheck
• SNS: publish + publishBatch + healthCheck
• Secrets Manager: set → get → list-by-prefix (force-delete cleanup)
• SQS FIFO: groupId/dedupId round-trip, dedup suppression, in-group ordering
• SQS DLQ: deadLetter() redrive with reason attribute, verified in DLQ
• SQS nack: redelivery with incremented receiveCount
• SQS getQueueDepth: 0 on empty → N after sends

Fix in 14ac8ea: getQueueDepth flaked (the only failure). ApproximateNumberOfMessages is eventually consistent in both directions, so the single post-send read could observe 0, and the global retry:2 reused the beforeAll queue (a retry inherited the prior attempt's messages, failing the 'starts empty' assertion). Now polls to convergence + retry:0. Confirmed stable across 2 consecutive full runs. The SDK was correct — on the failing retry, getQueueDepth accurately returned 3 for the leftover messages.