docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/process/conventions.md

@@ -132,12 +132,14 @@ always passes `wait_seconds: None`, an immediate peek.
 
 Per-row bookkeeping inside the broker:
 
+<!-- vale write-good.Passive = NO -->
 - `delivered_at = NOW` set on every popped row.
 - Each recipient has an in-memory `unacked_ids` list of every row
   delivered since the last `AckTurn`.
 - `redelivered = true` on a row if `RequeueInflight` resurfaced it
   (the harness prepends a "may already be handled" hint when this
   flag is set so the per-message warning is visible).
+<!-- vale write-good.Passive = YES -->
 
 `AgentRequest::AckTurn` closes out the in-memory list — the harness
 fires it after `TurnOutcome::Ok`, marking every message popped since
@@ -269,7 +271,7 @@ changes, and deserialization leniently accepts both the string form
 and the legacy bare integer (rolling-deploy skew, persisted blobs).
 **Input-direction** fields agents compute as epoch (`first_fire_at_unix`,
 schedule-edit `next_fire_at_unix`, `Wakeup::At`) stay integers. The
-`*_unix` field *names* are kept for now — renaming is the wire-types
+`*_unix` field *names* stay for now — renaming is the wire-types
 refactor's concern. The dashboard frontend parses via
 `util.js::epochSec` wherever it needs arithmetic and feeds the string
 straight to `new Date(s)` for display.

docs/process/gotchas.md

@@ -93,6 +93,8 @@ Two things to get right when a daemon needs outbound TCP:
   enumerate local addresses before it returns any, so name resolution
   fails without it even when the unit allows `AF_INET`.
 
+<!-- vale write-good.Passive = NO -->
+
 **The directive is a claim about what the program does, and nothing
 re-checks it when the program changes.** A unit that only served a unix
 socket when it was written is correct at `[ "AF_UNIX" ]` and silently wrong
@@ -101,6 +103,8 @@ the client — and when narrowing it, prefer a test that derives the required
 families from the code (which fails on the _next_ client too) over one that
 asserts today's list.
 
+<!-- vale write-good.Passive = YES -->
+
 ### `register_agent` is idempotent
 
 Drops any prior socket task before rebinding. Required so a
@@ -114,7 +118,7 @@ socket without needing a clean reinstall.
 `claude-code` comes from the flake's main `nixpkgs` (nixos-26.05).
 It's unfree, so the agent modules set `config.allowUnfreePredicate`
 at the container level to allowlist `claude-code` specifically —
-scoped, only this one package. This is needed because each per-agent
+scoped, only this one package, because each per-agent
 `nixosConfiguration` evaluates its own nixpkgs instance and the
 operator's host-level `allowUnfree` does **not** propagate in.
 Operators don't need to set anything on their side.
@@ -138,6 +142,8 @@ reference-less `-source` (so the runtime closure never arrives), and
 pure evaluation rejects. `services.hyperhive.agent.docs.source` gets away with being
 an input only because a docs tree has no runtime dependencies.
 
+<!-- vale write-good.Passive = NO -->
+
 The `storePath` trap is worth spelling out, because it's not confined
 to options the operator writes: **any** option of type `package` fed a
 store-path _string_ coerces through `lib.toDerivation`, i.e.
@@ -149,6 +155,10 @@ container as text in a real derivation — a symlink farm built from
 the interpolated string — before it can go anywhere a package is
 expected.
 
+<!-- vale write-good.Passive = YES -->
+
+<!-- vale write-good.Passive = NO -->
+
 The catch is that a path written into a generated flake is text, not a
 reference — the container's closure doesn't keep the binary alive.
 The **host** does: it interpolates the package into
@@ -160,6 +170,8 @@ the hive's `claude` out from under it. The price of the root is that
 `nix-collect-garbage` can't reclaim an old `claude-code` until every
 agent has rebuilt past it and the old generations are gone.
 
+<!-- vale write-good.Passive = YES -->
+
 ### Claude credentials are per-agent
 
 `/var/lib/hyperhive/agents/<name>/claude/` bind-mounts to
@@ -315,6 +327,8 @@ CI on drift).
 
 ### Split asset derivations away from the rust workspace
 
+<!-- vale write-good.Passive = NO -->
+
 `nix/packages/assets.nix` builds the branding SVG/PNG family + claude
 system-prompt template + claude-settings JSON as its own derivation,
 separate from the hive-ag3nt / hive-c0re crates. Reason: when the
@@ -327,6 +341,8 @@ its own — the split breaks the coupling at the derivation boundary.
 build time; librsvg dependency lives here, not in the rust
 derivation's `nativeBuildInputs`.
 
+<!-- vale write-good.Passive = YES -->
+
 ### `nix fmt` fails in a git worktree with "object not found"
 
 `nix fmt` (and any `nix` command that fetches a `git+file://` flake

docs/process/pr-review-gate.md

@@ -38,6 +38,8 @@ independently.
 
 ## What arming automerge actually means
 
+<!-- vale write-good.Passive = NO -->
+
 Automerge isn't "no human ever looked at this." Whoever arms it has
 already judged the PR sound at a coarse level — the signal it sends is
 roughly _"apart from maybe minor tweaks a reviewer can still catch,
@@ -46,6 +48,8 @@ already happened. No large changes are expected to surface after
 that point — a reviewer's job past that point is to flag it if one
 does, not to assume none ever will.
 
+<!-- vale write-good.Passive = YES -->
+
 The practical consequence for a reviewer: on a repo where someone with
 write access may already have armed automerge before your review
 lands, a plain `APPROVED` can