docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/turn-loop/claude-invocation.md

@@ -113,6 +113,8 @@ hyperhive owns compaction as policy: the `hive_claude::InfiniteSession`
 keeps the session alive across the context window with two triggers baked
 into its `run`:
 
+<!-- vale write-good.Passive = NO -->
+
 - **Reactive** — claude-code prints `Prompt is too long`. The session is
   _already_ past the window, so no turn can run on it — the session
   `/compact`s straight away and retries the same wake-up prompt once. No
@@ -123,11 +125,12 @@ into its `run`:
   (see [Turn outcomes](README.md#turn-outcomes) — the wake prompt itself is small, so
   the overflow was the accumulated context the archive clears).
 - **Proactive** — a turn finishes cleanly but the last inference's context
-  size crossed the policy watermark. While the session is still healthy it
-  runs one synthetic _notes-checkpoint_ turn (`CHECKPOINT_PROMPT` —
-  "context is filling up, flush durable state into `/state` now") and
-  _then_ `/compact`s, so the agent can persist in-flight state before the
-  detail collapses into a summary.
+size crossed the policy watermark. While the session is still healthy it
+runs one synthetic _notes-checkpoint_ turn (`CHECKPOINT_PROMPT` —
+"context is filling up, flush durable state into `/state` now") and
+_then_ `/compact`s, so the agent can persist in-flight state before the
+detail collapses into a summary.
+<!-- vale write-good.Passive = YES -->
 
 **hive-agent checks both triggers above between its own turns** —
 `PercentPolicy::should_compact` reads the percent watermark from the
@@ -236,8 +239,8 @@ needs to `chown` a bind mount), once at startup:
 - `claude-system-prompt.md` — rendered from
   `hive-agent/prompts/system.md` by `hive-agent`'s `prompt::render`:
   HTML-comment markers (`<!-- role:agent -->...<!-- /role:agent -->`,
-  same for `role:manager`) gate the role-specific blocks; everything
-  else is shared. Five placeholders are then
+  same for `role:manager`) gate the role-specific blocks; both flavors
+  share everything else. Five placeholders are then
   substituted: `{label}` (short agent name), `{qualified_label}`
   (hive-qualified `name@domain` form), `{operator_pronouns}`,
   `{hive_identity}` (for example `` on hive `pr1ma` ``; empty when
@@ -245,7 +248,7 @@ needs to `chown` a bind mount), once at startup:
   shape for the swarm). Pronouns come from `HIVE_OPERATOR_PRONOUNS`
   env (set by the meta flake from
   `services.hyperhive.c0re.operatorPronouns`, default `she/her`).
-  When `services.hyperhive.agent.docs.enable` is set, `HIVE_DOCS_DIR` is present
+  When you enable `services.hyperhive.agent.docs.enable`, `HIVE_DOCS_DIR` is present
   in the environment and `render()` appends a one-sentence pointer
   telling the agent where the docs live.
   Passed via `--system-prompt-file`.

docs/turn-loop/config.md

@@ -288,6 +288,8 @@ The file lives in the agent's bind-mounted **harness** dir, not `state/`
 (see `docs/agent-lifecycle/persistence.md`'s "Parent access to child state"), so an API
 key placed here is reachable by nothing but this agent and the host.
 
+<!-- vale write-good.Passive = NO -->
+
 ⚠️ Verified end-to-end against OpenRouter hasn't happened as of this
 writing — `ANTHROPIC_BASE_URL` support in the shipped Claude CLI is
 documented behavior, not something this hive has run a live turn
@@ -295,6 +297,8 @@ against yet. Tool use, streaming, and MCP all need to keep working
 through a non-Anthropic base URL; treat the first real agent on this
 path as the actual verification, not this doc.
 
+<!-- vale write-good.Passive = YES -->
+
 Switching an already-provisioned OAuth agent to `useApiKey` leaves
 `~/.claude/credentials.json` in place but unused — harmless, not
 cleaned up automatically. Cost shape also changes: subscription pricing