docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/integrations/knowledge.md

@@ -14,6 +14,8 @@ Inside any agent container:
 /knowledge/README.md # table of contents (seeded on first use)
 ```
 
+<!-- vale write-good.Passive = NO -->
+
 Agents read documents directly from that path. The mount is
 read-only — agents never write through it. To contribute, use the
 `hive-forge` AGit flow (no fork needed — see
@@ -21,6 +23,8 @@ read-only — agents never write through it. To contribute, use the
 the local clone updates automatically (see
 [Sync mechanism](#sync-mechanism) below).
 
+<!-- vale write-good.Passive = YES -->
+
 ## Repository layout
 
 Canonical forge location: `internal/knowledge` (org `internal`,
@@ -53,8 +57,8 @@ pull`, so agents see the new content on their next turn.
    URL, so a second registration against the same repo doesn't add a
    recipient — it takes delivery away from whoever registered first.
    Earlier versions had each hive register its own; hive-c0re now
-   removes its own leftover at startup, so no operator step is needed
-   to migrate.
+   removes its own leftover at startup, so migrating needs no operator
+   step.
 
 2. **Periodic pull** — a background task in `hive-c0re::main`
    pulls on a fixed cadence as a fallback (webhook missed, c0re
@@ -86,12 +90,15 @@ before returning.
 
 ## State
 
+<!-- vale write-good.Passive = NO -->
+
 - **Host clone**: `/var/lib/hyperhive/knowledge` — persists across
   hive-c0re restarts and agent destroy/recreate. Deleted only by
   manual operator action.
 - **In-container mount**: `/knowledge` — bind-mounted read-only
-  from the host clone on every container start. Gone when container
-  is stopped; reappears on next start with the current clone state.
+from the host clone on every container start. Gone when container
+is stopped; reappears on next start with the current clone state.
+<!-- vale write-good.Passive = YES -->
 
 The mount deliberately **excludes `.git`**: the host clone embeds the `core`
 token in `.git/config` (it rides the clone URL), so hive-priv overlays an empty