docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/swarm/sso.md

@@ -121,6 +121,8 @@ read that same value, so the redirect URI authelia accepts and the one
 the service actually sends can't drift apart. A mismatch there is a
 rejected login with no error text worth reading.
 
+<!-- vale write-good.Passive = NO -->
+
 ⚠️ The delivery is a copy, not a `bindMounts` entry, and deliberately so:
 nixos-container refuses to start a container whose bind source is
 missing, and this secret doesn't exist until authelia's first boot has
@@ -128,6 +130,8 @@ run. Binding it would make the service wait on a file that waits on a
 container that starts after it — on a fresh hive, a permanent stall
 presenting as "the forge is broken," many layers from its cause.
 
+<!-- vale write-good.Passive = YES -->
+
 ### 2. Swarm-managed services
 
 The controller side owns provisioning: `swarmctl` writes both halves, the