fix: harden OHE troubleshooting skill for customer use

[rajshah4]

HUMAN: I reviewed and exercised this troubleshooting workflow against a Replicated OpenHands Enterprise installation, including its read-only boundary and support-bundle path.

• A human has tested these changes.

Why

Customers and field engineers need a safe troubleshooting workflow aligned with current OpenHands Enterprise guidance. The skill must help collect useful evidence without encouraging ad hoc Kubernetes changes that can be overwritten or leave an installation inconsistent.

Summary

• aligns the troubleshooting skill introduced by feat: add openhands-enterprise-troubleshooting skill for OHE self-hosted debugging #456 with the current troubleshooting and VM log-collection documentation
• makes the initial investigation read-only and keeps the official Kubernetes warning prominent
• discovers version and topology before targeting resources
• uses supported pre-install and post-install support-bundle commands
• protects credentials, Secret contents, and sensitive bundle data
• requires OpenHands Support direction and administrator approval before mutations
• preserves reusable diagnosis, comparison, escalation, and handoff workflows

Issue Number

Fixes #517

How to Test

python3 skills/skill-creator/scripts/quick_validate.py skills/openhands-enterprise-troubleshooting
uv run --group test pytest -q

Also verify that:

1. SKILL.md displays the read-only Kubernetes warning before troubleshooting steps.
2. Failed-install collection uses the extracted installer binary.
3. Post-install collection uses /var/lib/embedded-cluster/bin/openhands support-bundle.
4. No normal workflow decodes Secrets or mutates Kubernetes resources.
5. The troubleshooting and VM log-collection documentation links resolve.

Video/Screenshots

Not applicable; this PR changes a text-based skill and reference material.

Notes

This PR intentionally targets skill/openhands-enterprise-troubleshooting, the head branch for #456. Merging it updates that stacked draft rather than creating a competing implementation against main.

Current documentation:

• https://docs.openhands.dev/enterprise/troubleshooting
• https://docs.openhands.dev/enterprise/vm-install/log-collection

This pull request was updated by an AI agent (OpenHands) on behalf of Rajiv Shah.

[all-hands-bot]

🚦 CI is currently failing on this PR's latest commit.

Please fix the failing checks before OpenHands reviews it - this is re-checked automatically once you push a new commit. (A maintainer can also request @all-hands-bot as a reviewer to have it reviewed regardless of CI status.)

This is an automated check - no AI was used to generate this comment.

[all-hands-bot]

🚦 CI is currently failing on this PR's latest commit.

Please fix the failing checks before OpenHands reviews it - this is re-checked automatically once you push a new commit. (A maintainer can also request @all-hands-bot as a reviewer to have it reviewed regardless of CI status.)

This is an automated check - no AI was used to generate this comment.

[rajshah4]

Confirmed the branch state: this PR has no merge conflicts with its intended stacked base (skill/openhands-enterprise-troubleshooting); the base commit is an ancestor of the current head b19041b.

I also updated the PR description to the current template and linked #517. The remaining CI failure is the known base-branch workflow problem addressed by #516. A maintainer must add the enhancement label to #517; its body now meets the enhancement readiness criteria, after which automation can add ready-for-dev.

This comment was generated by an AI agent (OpenHands) on behalf of Rajiv Shah.