docs: fix genuine passive-voice hits in docs/integrations

Sixth batch of the ongoing write-good.Passive pass (hyperhive#4042):
read all 52 hits across knowledge.md/github.md/matrix.md/forge.md in
context and rewrote 39 with a clearly nameable actor -- mostly
hive-c0re, forge_notify, or a specific fn named right there or a
sentence or two earlier. forge.md's notification poller is the
densest yet (19/20 hits rewritten): forge_notify is established as
the section's sole actor early and reused throughout, the shape
that's produced the highest catch rates all along.

Left 13 alone: the "no X is needed" negative-capability idiom (x2),
a container-lifecycle state descriptor ("when container is stopped"),
a false-positive tokenization ("read-only" split across a line wrap,
vale matches "is read" inside it -- not a real passive at all), the
"X can't be Yed" idiom, a generic "before the ids are minted" timing
clause with no natural actor to name, a room-join policy-state
descriptor, an "is enabled"/"is trusted" pair describing a config/
trust state (predicate-adjective-copula bucket, same family as
"is privileged" from an earlier batch), three "**X is required**"
bolded requirement-list labels (structural convention, not really
mid-sentence passives), and a contrastive "are shared" clause
mirrored against an active sibling clause exactly like
claude-invocation.md's "everything else is shared" from the
turn-loop batch -- left alone there for the same reason.

One sibling-inconsistency catch worth flagging: forge.md's merge-
racing-comment paragraph had two passive clauses ("is left off",
"is dropped") sitting next to a third, already-active clause
("appends nothing") in the same three-item parallel list -- rewrote
all three under one active subject (forge_notify) for consistency.

Verified via vale before/after: 52 -> 13 write-good.Passive hits,
exactly the 13 left alone above; error count and other warning
categories unchanged (still on TooWordy since #4097 hasn't merged to
this branch yet). Re-read every changed line in full surrounding
context after editing, matching the diff to intent before running
the final vale check.

docs/integrations/knowledge.md

@@ -28,8 +28,8 @@ repo `knowledge`). The repo is public, so every agent's forge account
 has read access without an explicit per-agent collaborator grant;
 only the `core` account has push access, for autoseeding.
 
-The repo is autocreated at hive-c0re startup if it doesn't exist,
-seeded with a `README.md` containing a contribution guide and a
+hive-c0re autocreates the repo at startup if it doesn't exist,
+seeding it with a `README.md` containing a contribution guide and a
 blank table of contents. Add an entry to that ToC each time you
 create a new document.
 
@@ -44,8 +44,8 @@ hive-c0re maintains the local clone at
    event to every hive over the swarm queue and each hive runs `git
 pull`, so agents see the new content on their next turn.
 
-   A hive that's offline when the event is sent doesn't get it on
-   reconnect — the periodic pull below is what closes that gap. One
+   A hive that's offline when the swarm controller sends the event
+   doesn't get it on reconnect — the periodic pull below is what closes that gap. One
    hive briefly showing older `/knowledge` content than another is
    expected, and resolves by itself within the fallback interval.
 
@@ -76,11 +76,11 @@ sender `system`, body `[system] /knowledge updated:` followed by a
 "see the repo" fallback if computing the diff itself fails). This is
 the same broadcast mechanism used for other hive-wide notices — inbox
 message only, no forced wake, and it carries the standard "this was a
-broadcast" hint. A diff or per-agent send failure is logged but never
-blocks the pull itself.
+broadcast" hint. hive-c0re logs a diff or per-agent send failure
+without blocking the pull itself.
 
-The local clone is created (or refreshed) once at startup via
-`knowledge::ensure_local_clone`. If the repo is brand new and
+`knowledge::ensure_local_clone` creates (or refreshes) the local
+clone once at startup. If the repo is brand new and
 empty, `ensure_local_clone` seeds it with the default README
 before returning.
 
@@ -105,8 +105,8 @@ write access, so they can't push a branch directly. The supported path
 is Forgejo's **AGit flow** through the `hive-forge` CLI — no fork
 required.
 
-1. Clone the repo (credentials are injected automatically; the `-r`
-   flag selects the repo, the clone lands in `./knowledge`):
+1. Clone the repo (`hive-forge` injects credentials automatically;
+   the `-r` flag selects the repo, the clone lands in `./knowledge`):
 
    ```sh
    hive-forge -r internal/knowledge clone