Fix force-push detection in daily-report skill (payload.forced is absent on private repos)

[automation-nsheaps]

Problem

plugins/daily-report/skills/daily-report/SKILL.md Step 3 tells the agent to detect force pushes with:

gh api "repos/${OWNER}/${REPO}/events" -q '.[] | select(.type == "PushEvent") | {... forced: .payload.forced ...}'

For private repositories the events API returns an abbreviated PushEvent payload:

{"repository_id":1165150589,"push_id":43364623104,"ref":"refs/heads/main",
 "head":"02659e7…","before":"bde6af7…"}

forced and size are absent. A select(.payload.forced == true) filter therefore matches
nothing, and the generated report silently asserts "no force pushes detected" when force pushes
did occur. This is a false negative, not a visible error.

Evidence (2026-09-11 window, nsheaps account)

• All 48 in-window PushEvents returned forced: null, size: null.
• Running GET /repos/{repo}/compare/{before}...{head} for each of those 48 pushes returned
  status: "diverged" for 12 of them — all real force pushes (Renovate branch rebases,
  ahead_by 1–14, behind_by 1).
• The documented filter would have reported 0.

Secondary issue: audit log is unreachable for the default scope

Step 3 presents GET /orgs/${ORG}/audit-log as the primary method. nsheaps is a user
account, not an organization, so that endpoint returns 404 Not Found unconditionally. The
skill should say so up front rather than framing it as "requires GitHub Enterprise or org admin".

Third issue: reports can exceed GitHub's issue-body limit

The 2026-09-11 report came to ~66,500 characters against GitHub's 65,536-character issue-body
cap. It only fit after shortening 40-char SHAs to 7 chars in /commit/ and /compare/ URLs
(saving ~3.7 KB). The skill gives no size budget or truncation strategy.

Proposed fix

In plugins/daily-report/skills/daily-report/SKILL.md:

1. Replace the payload.forced approach with compare-based inference, with a status table:
   ahead = fast-forward (not a force push); diverged/behind = force push;
   identical = no-op; comparison 404 = before was garbage-collected. Skip
   before == 000…0 (branch creation).
2. State that the org audit log 404s for user accounts and that the events API + compare is the
   normal path, not the exception.
3. Add a "Size budget" note under Output: keep the body under 65,536 characters; use
   7-character SHAs in /commit/ and /compare/ URLs; collapse high-churn repo tables into
   <details> if still over.

Bump plugins/daily-report/.claude-plugin/plugin.json (currently 0.1.7) per .claude/rules/versioning.md.

Why this wasn't fixed in-session

The session that found this (generating #797)
did not have write permission for plugins/daily-report/skills/daily-report/SKILL.md, so the
edit could not be applied. Filed per .claude/rules/workflow-self-improvement.md.

Related: #797