test(cli): assert toon default projection against stdout only; alert card parity

The stderr note embeds the default field names, so the merged-capture
toon subtest's positive assertions were satisfied by the note alone.
Switch it to the split capture and check the note on stderr, mirroring
the json subtest.

Also bring alert.md's alert-event list section to parity with the
incident card: name the default compact projection and the --fields
escape hatch.

Author: ysyneu

internal/cli/fieldproject_test.go

@@ -134,16 +134,21 @@ func TestIncidentListStructuredDefaultUsesCompactProjection(t *testing.T) {
 		stub := newGFStub(t)
 		stub.data = map[string]any{"items": []any{incidentRow()}, "total": 1}
 
-		out, err := execCommand("incident", "list", "--output-format", "toon")
+		out, stderrText, err := execCommandSplit("incident", "list", "--output-format", "toon")
 		if err != nil {
-			t.Fatalf("execCommand: %v", err)
+			t.Fatalf("execCommandSplit: %v", err)
 		}
 
+		// Positive keys must come from stdout alone: the stderr note embeds the
+		// same field names, so a merged capture would satisfy this vacuously.
 		for _, key := range []string{"incident_id", "title", "incident_severity", "progress", "start_time", "channel_id"} {
 			if !strings.Contains(out, key) {
 				t.Errorf("default toon output missing compact key %q, got:\n%s", key, out)
 			}
 		}
+		if !strings.Contains(stderrText, "note: rows projected to default compact fields") {
+			t.Errorf("default projection should announce itself on stderr, got:\n%s", stderrText)
+		}
 		for _, key := range []string{"responders", "labels", "description"} {
 			if strings.Contains(out, key) {
 				t.Errorf("default toon output should not contain full-record key %q, got:\n%s", key, out)

skills/flashduty/reference/alert.md

@@ -38,7 +38,7 @@ fduty alert feed <alert-id> --output-format toon
 fduty alert-event list --channel <channel-id> --since 1h --limit 30 --output-format toon
 ```
 
-Structured `alert-event list` output stays below 16 KiB. A trailing `...` means a long retained string was shortened.
+Structured `alert-event list` output stays below 16 KiB. A trailing `...` means a long retained string was shortened. In json/toon mode rows default to the compact projection `event_id,alert_id,event_severity,event_status,event_time,title` (a stderr note says so when it applies); any other response field is one `--fields` away — a key missing from the output means it wasn't selected, not that the server omits it.
 
 ## Hot flow — merge noisy alerts into an existing incident