docs(skills): point title search at --query instead of local jq matching

The stderr note added in this branch tells a caller when list values were
clipped, but the cheaper answer is not to match on them at all: incident
list already takes --query, a server-side full-text search over
title/labels/content that is unaffected by whatever the projection did to
the rendered value.

Filtering a page of list output locally is the pattern that runs into
clipped titles in the first place, and it also costs a page walk the server
could have skipped. Say so on the card, next to the existing --fields advice
that encourages projecting list scans down.

Author: ysyneu

skills/flashduty/reference/incident.md

@@ -494,6 +494,7 @@ Update a work item
 - **`similar` only works on channel-backed incidents** (those with a real `channel_id`). Manually created incidents with no channel return HTTP 400 "Channel not found" — this is expected, not transient. Fall back to `incident list --query "<keywords>"` for text search.
 - **`update` vs `reset`**: `update <id>` edits title/description/severity/custom fields. `reset <incident-id>` additionally supports `--impact`, `--root-cause`, `--resolution` (the AI narrative fields). Use `reset` for post-incident write-back.
 - **If `list` returns a `total`, use it instead of page-walking.** For "how many incidents are Triggered / Processing / Closed", run one filtered `incident list --progress <bucket> ...` per bucket and read the returned `total`. Do not fetch page 1/2/3 just to derive counts the server already computed.
+- **Search with `--query`, don't substring-match `title` from list output.** A `--fields` list projection may come back with long values clipped to fit its byte budget (a stderr note names the fields when it happens), so a local `jq test()` / `contains()` over `title` can miss rows that really do match, and an empty result is indistinguishable from a genuine non-match. `--query` is a server-side full-text search over title/labels/content — correct regardless of projection, and cheaper than pulling pages to filter locally. (It also resolves a 24-char `incident_id` or 6-char `num` to a direct lookup.)
 - **Use `--fields` to keep list scans compact.** When the goal is to identify matching incidents or collect IDs/numbers/titles, project only the needed columns first, then fetch one target incident with `detail` / `alerts` / `timeline`.
 - **`list` window cap**: `--since`/`--until` window must be < 31 days; `--limit` max 100. Empty result is authoritative — do not widen filters or retry.
 - **`merge` is irreversible**: source incidents are absorbed into target permanently. Always list and confirm both IDs before running.