Soft delete unhealthy endpoints

Blocked by: #356 , #367 #390

**Use Case**

When a health check is failing, we don't currently remove the unhealthy endpoint from the DNS provider. An unhealthy endpoint should be removed from the DNS provider as long as it wont result in a NXDoman response

When reconciling a DNS Record, label any unhealthy endpoints with "soft_delete"

**Test Cases**

- New test to ensure DNS response is correct when an unhealthy cluster removed
- New test to ensure DNS response is correct when an unhealthy cluster is identified but not removed (IE removing a whole GEO)

**Document**

We will want to update the health check documentation to call out this new behaviour including not removing a GEO

Start with the DNS record reconciliation entry point and existing health-check tests; the issue does not name specific files. Add tests for removing an unhealthy cluster and for retaining a GEO when removal would produce an NXDOMAIN response, then update the health-check documentation to describe soft deletion and GEO behavior.

Written by the indexing model from the issue text.