treefmt normalises markdown emphasis to underscores; the file was
written with asterisks and never run through `nix fmt`. Also ends the
sentence before the scoping note with a full stop rather than a colon,
since a paragraph now sits between it and the example block.
Refs #4460
The worked example keyed a stream selector on `_HOSTNAME`, which the
collector config warns against: a hostname is a config value two
machines can share, so keying on it merges their streams. Use
`_MACHINE_ID`, which is the field that actually distinguishes them.
Refs #4460
`swarm-logs --help` documents the CLI surface but not the LogsQL
constructs an agent needs to build a bounded query with it: no
time predicate, and no way to know a bare word matches across the
whole swarm rather than one hive. Add a skill teaching `_time:`
predicates, hive/service scoping via the collector's stream
fields, message vs json format, distinguishing an empty result
from a refused request, and running a control query before
trusting an empty one.
Refs #4460
