docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/getting-started/setup.md

@@ -10,12 +10,16 @@ sequence. All `hivectl` commands below run as **root on the host** (not
 inside an agent container); the `request_*` steps run from ruth's own
 turn via the MCP tools.
 
+<!-- vale write-good.Passive = NO -->
+
 **Bringing up a hive that doesn't host its own swarm services?** Read
 [`swarm/secrets.md`](../swarm/secrets.md) first. Everything below assumes
 each credential is generated where it's read, which is true on an
 all-local deploy and not otherwise — that page says which files an
 operator has to place, and where.
 
+<!-- vale write-good.Passive = YES -->
+
 ## Step-by-step
 
 ### 1 · Forge
@@ -157,7 +161,7 @@ leaves it alone.
 
 </details>
 
-Whether anything more is needed depends on
+What else you need depends on
 `services.hyperhive.deploy.bao.seal`:
 
 - **`pkcs11`** (the default) — pkcs11 binds the key to the host's TPM, and
@@ -180,8 +184,6 @@ the store can't hand you, being what opens it. ⚠️ Not the gateway's HTTPS ce
 store that took its identity from an authority it will itself distribute could
 never come up before that authority.
 
-Making even the `init` unnecessary is tracked as a follow-up.
-
 ### 4 · Swarm SSO (only when `deploy.authelia`)
 
 ⚠️ **Required to finish the install, not optional.** Authelia treats an
@@ -287,17 +289,20 @@ See [`tools/hivectl.md`](../tools/hivectl.md) for every `hivectl` verb.
 
 ## Security notes
 
+<!-- vale write-good.Passive = NO -->
+
 - **No forge admin token is stored in any agent state dir.** Agents
   hold a regular agent token in their `forge-token` file; sensitive
   creds (the core token, the matrix admin token) live on the host.
 - All config changes (forge PRs on `agent-configs/<name>`) go through
   operator approval — agents can't unilaterally rebuild containers, by design.
   See [`boundary.md`](../trust-boundary/boundary.md) and [`security.md`](../trust-boundary/security.md).
-- **Telemetry ingest is authenticated per hive**, and the `hive` label comes
-  from which hive authenticated rather than from the payload — so no hive can
-  report metrics as another. A first-run all-local hive gets this with nothing
-  to configure; joining a swarm you don't host needs one secret copied across.
-  See [`observability.md`](../scheduler/observability.md#authenticated-ingest).
+- **Each hive authenticates its own telemetry ingest**, and the `hive` label comes
+from which hive authenticated rather than from the payload — so no hive can
+report metrics as another. A first-run all-local hive gets this with nothing
+to configure; joining a swarm you don't host needs one secret copied across.
+See [`observability.md`](../scheduler/observability.md#authenticated-ingest).
+<!-- vale write-good.Passive = YES -->
 
 Once the hive is running, ruth records anything it needs to remember
 across restarts in `/agents/ruth/state/notes.md`.