Address post-merge Copilot findings from #834 (#836)

- Raise the compliance table's TSVB pivot_rows from 1000 to 10000,
  matching the 10k terms size of the agg-based table it replaced, so
  large installations don't lose per-domain rows.
- Guard the Splunk compliance column's division explicitly:
  if(Messages>0, round(...), null()). SPL already returns NULL on
  division by zero, and null (not 0.0%) matches the PostgreSQL panel's
  NULLIF behavior for zero-message domains, so this makes the intended
  semantics explicit without changing results.

Both verified against the dashboard dev stack: the guarded SPL returns
identical values on seeded data, and the ndjson was round-tripped
through OSD (global tenant) and re-imports 26/26 into both OSD and
Kibana 8.19.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

dashboards/splunk/dmarc_aggregate_dashboard.xml

@@ -191,7 +191,7 @@
       <title>Message volume and DMARC compliance by from domain</title>
       <table>
         <search base="base_search">
-          <query>| stats sum(message_count) as Messages, sum(eval(if(passed_dmarc="true", message_count, 0))) as passed by header_from | eval "% DMARC Compliant"=round(passed/Messages*100, 1) | fields - passed | rename header_from as "From Domain" | sort -Messages</query>
+          <query>| stats sum(message_count) as Messages, sum(eval(if(passed_dmarc="true", message_count, 0))) as passed by header_from | eval "% DMARC Compliant"=if(Messages>0, round(passed/Messages*100, 1), null()) | fields - passed | rename header_from as "From Domain" | sort -Messages</query>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>