Update NGSIEM start_search keyword guidance for FalconPy 1.6.5

[mraible]

FalconPy 1.6.5 fixed the bug where body= was silently ignored by NGSIEM.start_search() (#1497, closes #1491). The skill previously stated body= is broken; it now notes that body= works on 1.6.5+ but recommends search= as the version-agnostic default since FalconPy is unpinned.

No example code changed. search= remains in all examples.

[app-foundry-fusion-prodsec-142274]

Foundry Skills Eval Results

1/1 evals passed (100%) · model claude-opus-4-6 · commit 0519133

Eval	Result	Prompt
logscale-query-function	✅	details I need a Foundry app that queries workflow execution data from LogScale. It should have a Python function that runs a LogScale query against the "fusion" repository to get workflow execution statistics (success/failure counts, average duration) for the last 24 hours, and a UI page that displays the results.

_{On-demand eval run. Re-runs update this comment in place.}

[mraible]

Verified the claim against the v1.6.5 dev build on TestPyPI (discussion #1505), offline, since the guard is client side.

The relevant line in NGSIEM.start_search:

• 1.6.4: search = kwargs.get("search", None) and then body=search, so a caller passing body= has it silently replaced by None
• 1.6.5: search = kwargs.get("search", None) or body, so body= is honored as a fallback

search= is checked first in both, which is why it stays the version-agnostic recommendation while FalconPy is unpinned. Worth noting the 1.6.4 docstring already said search "can be used instead of body", so the documentation promised the behavior the guard did not implement.

No change needed to this PR. Stable release is planned for 2026-08-20, so it can come out of draft then.