docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/agent-lifecycle/approvals.md

@@ -148,9 +148,10 @@ through the web UI or the forge.
 ### Approval kinds (wire shapes)
 
 `ApprovalKind` carries four variants; each maps to a different
-`commit_ref` encoding because that field is overloaded as the
-kind-specific payload carrier.
+`commit_ref` encoding because `ApprovalKind` overloads that field as
+the kind-specific payload carrier.
 
+<!-- vale write-good.Passive = NO -->
 - `MergeConfigPr` — the config-change flow. Triggered automatically:
   when an agent opens (or force-pushes) a PR on its
   `agent-configs/<agent>` forge repo, hive-c0re's `/webhook/config-pr`
@@ -187,6 +188,7 @@ kind-specific payload carrier.
   `source = approval:<id>`; the worker fans the body out as
   inbox messages to each target at the scheduled time, recurring
   when `interval_seconds` is set.
+<!-- vale write-good.Passive = YES -->
 
 ### Scheduled prompts (submit paths)