[text-auditor] Batch fix clear grammar issues in field/docs descriptions (belongs/allow)

## Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort fix.

### 1. Redundant preposition: `to which ... belongs to` → `to which ... belongs`

**Why:** This is a clear grammar error (double preposition) in user-facing field descriptions and mirrored docs.

**Verified occurrences:**
- **File:** `packages/istio/data_stream/access_logs/fields/fields.yml` (line 71)
**Current text:** `Upstream cluster to which the upstream host belongs to. alt_stat_name will be used if provided.`
**Suggested fix:** `Upstream cluster to which the upstream host belongs. alt_stat_name will be used if provided.`
- **File:** `packages/hashicorp_vault/data_stream/audit/fields/fields.yml` (line 28)
**Current text:** `Entity ID is the identifier of the entity in identity store to which the identity of the authenticating client belongs to.`
**Suggested fix:** `Entity ID is the identifier of the entity in identity store to which the identity of the authenticating client belongs.`
- **File:** `packages/nozomi_networks/data_stream/node/fields/fields.yml` (line 343)
**Current text:** `The zone name to which this node belongs to.`
**Suggested fix:** `The zone name to which this node belongs.`
- **File:** `packages/nozomi_networks/data_stream/variable/fields/fields.yml` (line 47)
**Current text:** `The node to which this variable belongs to.`
**Suggested fix:** `The node to which this variable belongs.`
- **File:** `packages/nozomi_networks/data_stream/variable/fields/fields.yml` (line 50)
**Current text:** `The label of the node to which this variable belongs to.`
**Suggested fix:** `The label of the node to which this variable belongs.`
- **File:** `packages/istio/docs/README.md` (line 195)
- **File:** `packages/hashicorp_vault/docs/README.md` (line 262)
- **File:** `packages/nozomi_networks/docs/README.md` (lines 1553, 2099, 2100)

### 2. Missing preposition: `which this alert belongs` → `to which this alert belongs`

**Why:** Clear grammar error in a user-facing threat field description and mirrored docs.

**Verified occurrences:**
- **File:** `packages/carbon_black_cloud/data_stream/alert_v7/fields/fields.yml` (line 72)
**Current text:** `The identifier of a threat which this alert belongs. Threats are comprised of a combination of factors that can be repeated across devices.`
**Suggested fix:** `The identifier of a threat to which this alert belongs. Threats are comprised of a combination of factors that can be repeated across devices.`
- **File:** `packages/carbon_black_cloud/docs/README.md` (line 507)

### 3. Subject-verb agreement: plural subject with singular `belongs`

**Why:** `domains`/`IPs` are plural, so verb should be `belong`.

**Verified occurrences:**
- **File:** `packages/cloudflare_logpush/data_stream/gateway_dns/fields/fields.yml` (line 27)
**Current text:** `ID or IDs of category that the intermediate cname domains belongs to.`
**Suggested fix:** `ID or IDs of category that the intermediate cname domains belong to.`
- **File:** `packages/cloudflare_logpush/data_stream/gateway_dns/fields/fields.yml` (line 30)
**Current text:** `Name or names of category that the intermediate cname domains belongs to.`
**Suggested fix:** `Name or names of category that the intermediate cname domains belong to.`
- **File:** `packages/cloudflare_logpush/data_stream/gateway_dns/fields/fields.yml` (line 96)
**Current text:** `ID or IDs of category that the queried domains belongs to.`
**Suggested fix:** `ID or IDs of category that the queried domains belong to.`
- **File:** `packages/cloudflare_logpush/data_stream/gateway_dns/fields/fields.yml` (line 99)
**Current text:** `Name or names of category that the queried domains belongs to.`
**Suggested fix:** `Name or names of category that the queried domains belong to.`
- **File:** `packages/cloudflare_logpush/data_stream/gateway_dns/fields/fields.yml` (line 240)
**Current text:** `ID or IDs of category that the IPs in the response belongs to.`
**Suggested fix:** `ID or IDs of category that the IPs in the response belong to.`
- **File:** `packages/cloudflare_logpush/data_stream/gateway_dns/fields/fields.yml` (line 243)
**Current text:** `Name or names of category that the IPs in the response belongs to.`
**Suggested fix:** `Name or names of category that the IPs in the response belong to.`
- **File:** `packages/cloudflare_logpush/docs/README.md` (lines 2132, 2133, 2149, 2150, 2184, 2185)

### 4. Subject-verb agreement: `this field allow` → `this field allows`

**Why:** Clear grammatical error in user-facing field description and mirrored docs.

**Verified occurrences:**
- **File:** `packages/nozomi_networks/data_stream/asset/fields/fields.yml` (line 101)
**Current text:** `Since os and firmware cannot be present at the same time, this field allow to get either of the two in a coalesce-like manner.`
**Suggested fix:** `Since os and firmware cannot be present at the same time, this field allows either of the two values to be used in a coalesce-like manner.`
- **File:** `packages/nozomi_networks/docs/README.md` (line 720)

## Suggested Actions

- [ ] Fix all `to which ... belongs to` occurrences in the listed field files and mirrored README tables.
- [ ] Fix `which this alert belongs` in Carbon Black field/docs text.
- [ ] Replace `belongs` with `belong` for all listed Cloudflare plural-subject descriptions (field + docs).
- [ ] Replace `this field allow` with `this field allows` in Nozomi asset field/docs text.
- [ ] Regenerate package docs/tables as needed so `fields.yml` and docs stay in sync.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Text Auditor](https://github.com/elastic/integrations/actions/runs/27272397233)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Jun 17, 2026, 11:24 AM UTC