[docs-patrol] Document new filestream auditd option and autoops_es exported fields

Recent code changes in the repository have introduced documentation drift. The following changes need corresponding documentation updates.

## Changes Requiring Documentation Updates

### 1. Filestream `auditd` parser added `include_raw_message`, but Filebeat docs do not list it

**Commit(s):**
- https://github.com/elastic/beats/commit/c66ae6c55c4d041cce9b421f56f89de631341dfa

**What changed:**
- `libbeat/reader/auditd/config.go:63` adds `IncludeRawMessage bool `config:"include_raw_message"`` (default `false` at `libbeat/reader/auditd/config.go:75`).
- `libbeat/reader/auditd/coalesce.go:260` now sets `msg.Content` from joined raw records when enabled, changing user-visible event content.

**Documentation impact:**
- `docs/reference/filebeat/filebeat-input-filestream.md:1052-1068` lists auditd parser options (`mode`, `log_errors`, `add_error_key`, `resolve_ids`) but does not include `include_raw_message`.
- Users cannot discover/configure this public parser option in Filebeat docs.

### 2. AutoOps ES started emitting new fields that are missing from exported fields docs

**Commit(s):**
- https://github.com/elastic/beats/commit/10f99612809123caaaffa9a66f200ed9f009ec3a
- https://github.com/elastic/beats/commit/d6df5156a4174b58ee5b5aa34e85a3b13beeb8db

**What changed:**
- `x-pack/metricbeat/module/autoops_es/node_stats/data.go:38-39` maps new node attributes: `logical_availability_zone` and `instance_configuration`.
- `x-pack/metricbeat/module/autoops_es/node_stats/node_stats.go:14` adds both attributes to `filter_path`, confirming intended collection.
- `x-pack/metricbeat/module/autoops_es/cluster_settings/data.go:35` maps `flood_stage_frozen` from `flood_stage.frozen`.

**Documentation impact:**
- `docs/reference/metricbeat/exported-fields-autoops_es.md` has no entries for `node.stats.attributes.logical_availability_zone` or `node.stats.attributes.instance_configuration`.
- `x-pack/metricbeat/module/autoops_es/cluster_settings/_meta/fields.yml:55-63,230-238,405-413` and generated docs `docs/reference/metricbeat/exported-fields-autoops_es.md:335-347,531-543,727-739` list only `watermark.low/high/flood_stage` and omit `watermark.flood_stage_frozen`.

## Suggested Actions

- [ ] Add `include_raw_message` to `docs/reference/filebeat/filebeat-input-filestream.md` auditd parser options, including default and coalesce-mode behavior.
- [ ] Add AutoOps node attribute fields (`logical_availability_zone`, `instance_configuration`) to `x-pack/metricbeat/module/autoops_es/node_stats/_meta/fields.yml` and regenerate `docs/reference/metricbeat/exported-fields-autoops_es.md`.
- [ ] Add AutoOps `watermark.flood_stage_frozen` to `x-pack/metricbeat/module/autoops_es/cluster_settings/_meta/fields.yml` (defaults/persistent/transient) and regenerate exported fields docs.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/beats/actions/runs/34853567710)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Sep 21, 2026, 2:21 PM UTC

Start by comparing the cited Go source files with docs/reference/filebeat/filebeat-input-filestream.md and the AutoOps metadata under x-pack/metricbeat/module/autoops_es. Check the existing exported-fields generation workflow, then update the named auditd and AutoOps field documentation. Done means all listed options and fields, including defaults and watermark variants, appear in the source metadata and regenerated exported-fields docs.

Written by the indexing model from the issue text.