docs: suppress reviewed write-good.Passive false positives

133 hits across 38 files, all previously classified during #4548's sweep
and deliberately left un-rewritten (predicate-adjective state/necessity
description, design-intent idiom, structural/type-description idiom,
no-single-actor topology claim, parallel-triple exception, vale
substring-match artifact — see hyperhive#4548's per-PR bodies for the
per-hit reasoning).

Wraps each one in a scoped <!-- vale write-good.Passive = NO/YES -->
pair (the supported mechanism — TokenIgnores has a known offset-drift
bug) rather than a blanket per-file or per-rule silence, so a *new*
passive-voice hit anywhere in these files still fails once the rule
gates CI (next commit). Table/list false positives (docs/swarm/credentials.md's
renewal-table cells) wrap the whole block, not each cell.

Part of #4546.

docs/turn-loop/config.md

@@ -288,6 +288,8 @@ The file lives in the agent's bind-mounted **harness** dir, not `state/`
 (see `docs/agent-lifecycle/persistence.md`'s "Parent access to child state"), so an API
 key placed here is reachable by nothing but this agent and the host.
 
+<!-- vale write-good.Passive = NO -->
+
 ⚠️ Verified end-to-end against OpenRouter hasn't happened as of this
 writing — `ANTHROPIC_BASE_URL` support in the shipped Claude CLI is
 documented behavior, not something this hive has run a live turn
@@ -295,6 +297,8 @@ against yet. Tool use, streaming, and MCP all need to keep working
 through a non-Anthropic base URL; treat the first real agent on this
 path as the actual verification, not this doc.
 
+<!-- vale write-good.Passive = YES -->
+
 Switching an already-provisioned OAuth agent to `useApiKey` leaves
 `~/.claude/credentials.json` in place but unused — harmless, not
 cleaned up automatically. Cost shape also changes: subscription pricing