[text-auditor] Batch fix clear user-facing typo families in manifests, docs, fields, and mage error text

## Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort fix.

### 1. `patters` typo in file selector descriptions across package manifests

**Current text:** `This is a list of selectors which is made up of regex patters.`
**Suggested fix:** `This is a list of selectors made up of regex patterns.` (or minimally `...regex patterns.`)
**Why:** Clear spelling error repeated across user-visible integration settings text.

**Search pattern used for completeness:** `\bpatters\b` in `packages/**/manifest.yml`

**Occurrences:**
- `packages/azure_blob_storage/manifest.yml` (line 146)
- `packages/azure_network_watcher_nsg/data_stream/log/manifest.yml` (line 107)
- `packages/azure_network_watcher_vnet/data_stream/log/manifest.yml` (line 107)
- `packages/cloudflare_logpush/data_stream/access_request/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/audit/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/casb/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/device_posture/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/dlp_forensic_copies/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/dns/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/dns_firewall/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/email_security_alerts/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/firewall_event/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/gateway_dns/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/gateway_http/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/gateway_network/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/http_request/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/magic_ids/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/nel_report/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/network_analytics/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/network_session/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/page_shield_events/manifest.yml` (line 345)
- `packages/cloudflare_logpush/data_stream/sinkhole_http/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/spectrum_event/manifest.yml` (line 359)
- `packages/cloudflare_logpush/data_stream/workers_trace/manifest.yml` (line 359)
- `packages/github/data_stream/audit/manifest.yml` (lines 610, 754)
- `packages/google_cloud_storage/manifest.yml` (line 132)
- `packages/netskope/data_stream/alerts_events_v2/manifest.yml` (line 115)
- `packages/netskope/data_stream/transaction/manifest.yml` (lines 97, 257)
- `packages/panw_cortex_xdr/data_stream/event/manifest.yml` (line 112)
- `packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml` (lines 185, 321)
- `packages/symantec_endpoint_security/data_stream/event/manifest.yml` (lines 326, 483)

### 2. `auxilary` typo in 1Password docs and field descriptions

**Current text:** `Any auxilary ... related to the event.`
**Suggested fix:** `Any auxiliary ... related to the event.`
**Why:** Clear spelling error in user-facing field documentation.

**Search pattern used for completeness:** `\bauxilary\b`

**Occurrences:**
- `packages/1password/docs/README.md` (lines 282, 283, 284)
- `packages/1password/data_stream/audit_events/fields/fields.yml` (lines 42, 45, 60)

### 3. `occured` typo in user-facing field descriptions/documentation text

**Current text (examples):**
- `...actual time an event occured...`
- `...activity occured...`
- `...error occured`

**Suggested fix:** Replace `occured` with `occurred` in description text.

**Why:** Clear spelling error repeated in user-visible field description surfaces.

**Search pattern used for completeness:** `\boccured\b` in docs/fields surfaces (`packages/**/docs/**/*.md`, `packages/**/fields/**/*.yml`), excluding schema keys/literal payload examples.

**Occurrences (description/doc text):**
- `packages/bluecoat/docs/README.md` (line 742)
- `packages/bluecoat/data_stream/director/fields/fields.yml` (line 190)
- `packages/checkpoint_harmony_endpoint/docs/README.md` (line 753)
- `packages/checkpoint_harmony_endpoint/data_stream/threatemulation/fields/fields.yml` (line 86)
- `packages/cylance/docs/README.md` (line 659)
- `packages/cylance/data_stream/protect/fields/fields.yml` (line 190)
- `packages/fortinet_forticlient/docs/README.md` (line 899)
- `packages/fortinet_forticlient/data_stream/log/fields/fields.yml` (line 190)
- `packages/juniper_junos/docs/README.md` (line 845)
- `packages/juniper_junos/data_stream/log/fields/fields.yml` (line 190)
- `packages/juniper_netscreen/docs/README.md` (line 832)
- `packages/juniper_netscreen/data_stream/log/fields/fields.yml` (line 190)
- `packages/netscout/docs/README.md` (line 743)
- `packages/netscout/data_stream/sightline/fields/fields.yml` (line 190)
- `packages/radware/docs/README.md` (line 742)
- `packages/radware/data_stream/defensepro/fields/fields.yml` (line 190)
- `packages/slack/docs/README.md` (line 67)
- `packages/slack/data_stream/audit/fields/fields.yml` (line 45)
- `packages/sophos_central/docs/README.md` (lines 319, 331)
- `packages/sophos_central/data_stream/alert/fields/fields.yml` (lines 195, 231)
- `packages/tomcat/docs/README.md` (line 667)
- `packages/tomcat/data_stream/log/fields/fields.yml` (line 190)
- `packages/trend_micro_vision_one/docs/README.md` (line 456)
- `packages/trend_micro_vision_one/data_stream/audit/fields/fields.yml` (line 24)

### 4. Typo/awkward wording in mage runtime error text

**Files:** `magefile.go` (lines 191, 243)

- **Current text:** `return fmt.Errorf("faile")`
**Suggested fix:** Replace with a complete message (for example, `failed to ...`) and include context if available.
- **Current text:** `failed to convert to int env. variable CI_MAX_TESTS_REPORTED %s: %w`
**Suggested fix:** `failed to convert environment variable CI_MAX_TESTS_REPORTED to int (%s): %w`

**Why:** One message is a clear typo/incomplete runtime error; the other is awkward user-facing error wording.

## Suggested Actions

- [ ] Replace all `patters` occurrences with `patterns` in manifest descriptions listed above.
- [ ] Replace all `auxilary` occurrences with `auxiliary` in 1Password docs/fields.
- [ ] Replace `occured` with `occurred` in the listed docs/field descriptions (excluding schema keys and literal example payloads).
- [ ] Improve the two user-facing mage error strings in `magefile.go`.

> [!NOTE]
>
> 🔒 Integrity filtering filtered 3 items
>
> Integrity filtering activated and filtered the following items during workflow execution.
> This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.
>
> - issue:elastic/integrations#18230 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18242 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
> - issue:elastic/integrations#18214 (`issue_read`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Text Auditor](https://github.com/elastic/integrations/actions/runs/24130511634)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 15, 2026, 10:32 AM UTC