One bad Kafka record shouldn't crash a Flink Stateful Functions job

A single null-key record crashed a whole Stateful Functions job. KZM-3.5 ships invalidRecordHandling - skip by default, strict fail per topic, full per-record diagnostics.