docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/process/conventions.md

@@ -132,12 +132,14 @@ always passes `wait_seconds: None`, an immediate peek.
 
 Per-row bookkeeping inside the broker:
 
+<!-- vale write-good.Passive = NO -->
 - `delivered_at = NOW` set on every popped row.
 - Each recipient has an in-memory `unacked_ids` list of every row
   delivered since the last `AckTurn`.
 - `redelivered = true` on a row if `RequeueInflight` resurfaced it
   (the harness prepends a "may already be handled" hint when this
   flag is set so the per-message warning is visible).
+<!-- vale write-good.Passive = YES -->
 
 `AgentRequest::AckTurn` closes out the in-memory list — the harness
 fires it after `TurnOutcome::Ok`, marking every message popped since
@@ -269,7 +271,7 @@ changes, and deserialization leniently accepts both the string form
 and the legacy bare integer (rolling-deploy skew, persisted blobs).
 **Input-direction** fields agents compute as epoch (`first_fire_at_unix`,
 schedule-edit `next_fire_at_unix`, `Wakeup::At`) stay integers. The
-`*_unix` field *names* are kept for now — renaming is the wire-types
+`*_unix` field *names* stay for now — renaming is the wire-types
 refactor's concern. The dashboard frontend parses via
 `util.js::epochSec` wherever it needs arithmetic and feeds the string
 straight to `new Date(s)` for display.