[docs-patrol] Update Winlogbeat docs for event_logs.forwarded gap-detection behavior

Recent code changes in the repository have introduced documentation drift. The following change needs a corresponding documentation update.

## Changes Requiring Documentation Updates

### 1. `event_logs.forwarded` now also disables record-ID gap detection

**Commit(s):**
- 7fab5feb2fb6390c4b154cb54c3699b4a70239c8 ([Fix gap detection to skip forwarded events (#49819)](https://github.com/elastic/beats/commit/7fab5feb2fb6390c4b154cb54c3699b4a70239c8))

**What changed:**
- `winEventLog.shouldDetectGap` now returns `false` for forwarded logs, so Winlogbeat skips Record ID gap detection/recovery when `event_logs.forwarded` is enabled (or for `ForwardedEvents` default behavior).
- Evidence:
- `winlogbeat/eventlog/wineventlog.go` lines 194-199 (`shouldDetectGap` includes `l.isForwarded()` guard)
- `winlogbeat/eventlog/wineventlog.go` lines 501-512 (gap detection/reset path)
- `winlogbeat/eventlog/wineventlog_retry_test.go` includes cases `"forwarded channel skips gap detection"` and `"forwarded flag skips gap detection"`

**Documentation impact:**
- `docs/reference/winlogbeat/configuration-winlogbeat-options.md` (`event_logs.forwarded` section, lines 173-177) currently documents only rendering optimization.
- It should also document that forwarded mode bypasses record-ID gap detection/recovery for non-contiguous forwarded streams, so users understand behavior and troubleshooting implications.

## Suggested Actions

- [ ] Update the `event_logs.forwarded` docs in `docs/reference/winlogbeat/configuration-winlogbeat-options.md` to include the new gap-detection behavior.
- [ ] Add a short troubleshooting note clarifying why forwarded channels with non-contiguous Record IDs no longer trigger subscription reset behavior when `forwarded` is true.

> [!NOTE]
>
> 🔒 Integrity filtering filtered 15 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - resource:search_pull_requests (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49886 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49193 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49520 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49378 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49573 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49586 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49811 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/beats#49782 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:#unknown (`search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49819](https://github.com/elastic/beats/pull/49819) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49820](https://github.com/elastic/beats/pull/49820) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49821](https://github.com/elastic/beats/pull/49821) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - [#49257](https://github.com/elastic/beats/pull/49257) (`search_pull_requests`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/beats/actions/runs/24035488792)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 13, 2026, 2:29 PM UTC

Read docs/reference/winlogbeat/configuration-winlogbeat-options.md and compare the event_logs.forwarded section with winlogbeat/eventlog/wineventlog.go and the cited retry tests. Update the section and add the requested troubleshooting note explaining that forwarded streams skip Record ID gap detection and subscription recovery. Done means the documented behavior matches the implementation and tests.

Written by the indexing model from the issue text.