docs: fix genuine passive-voice hits in docs/integrations

Sixth batch of the ongoing write-good.Passive pass (hyperhive#4042):
read all 52 hits across knowledge.md/github.md/matrix.md/forge.md in
context and rewrote 39 with a clearly nameable actor -- mostly
hive-c0re, forge_notify, or a specific fn named right there or a
sentence or two earlier. forge.md's notification poller is the
densest yet (19/20 hits rewritten): forge_notify is established as
the section's sole actor early and reused throughout, the shape
that's produced the highest catch rates all along.

Left 13 alone: the "no X is needed" negative-capability idiom (x2),
a container-lifecycle state descriptor ("when container is stopped"),
a false-positive tokenization ("read-only" split across a line wrap,
vale matches "is read" inside it -- not a real passive at all), the
"X can't be Yed" idiom, a generic "before the ids are minted" timing
clause with no natural actor to name, a room-join policy-state
descriptor, an "is enabled"/"is trusted" pair describing a config/
trust state (predicate-adjective-copula bucket, same family as
"is privileged" from an earlier batch), three "**X is required**"
bolded requirement-list labels (structural convention, not really
mid-sentence passives), and a contrastive "are shared" clause
mirrored against an active sibling clause exactly like
claude-invocation.md's "everything else is shared" from the
turn-loop batch -- left alone there for the same reason.

One sibling-inconsistency catch worth flagging: forge.md's merge-
racing-comment paragraph had two passive clauses ("is left off",
"is dropped") sitting next to a third, already-active clause
("appends nothing") in the same three-item parallel list -- rewrote
all three under one active subject (forge_notify) for consistency.

Verified via vale before/after: 52 -> 13 write-good.Passive hits,
exactly the 13 left alone above; error count and other warning
categories unchanged (still on TooWordy since #4097 hasn't merged to
this branch yet). Re-read every changed line in full surrounding
context after editing, matching the diff to intent before running
the final vale check.

docs/integrations/matrix.md

@@ -49,8 +49,8 @@ homeserver.
 ⚠️ **they're still not interchangeable, and the difference is the
 cost of changing one.** `gatewayHost` is a routing detail clients
 rediscover through `.well-known`, so it's safe to move on a running
-deployment. `serverName` is baked into every user and room id, so
-adopting a new one does **not** rename the existing users and rooms —
+deployment. The matrix id format bakes `serverName` into every user and
+room id, so adopting a new one does **not** rename the existing users and rooms —
 it strands them, because their ids still name a homeserver that no
 longer answers.
 
@@ -125,8 +125,8 @@ see it. The agent only receives the resulting `access_token`.
 6. **hive-c0re restarts `hive-matrix-daemon`** for the agent
    immediately after writing the token so the daemon picks up the
    new credential without waiting for a full container restart. If
-   the restart fails (for example daemon not yet running on first boot) the
-   error is logged as a warning and the `.path`-trigger sibling
+   the restart fails (for example daemon not yet running on first boot)
+   hive-c0re logs the error as a warning and the `.path`-trigger sibling
    (`hive-matrix-daemon.path` watching for `matrix-token` appearance)
    brings the daemon up on the same boot cycle anyway.
 
@@ -135,7 +135,7 @@ Initial rollout settings:
 - `allow_federation = true` at the protocol level so swarms can be
   wired up later by extending `trustedServers` without a homeserver
   restart. `trusted_servers = []` keeps it effectively closed
-  until peers are listed.
+  until you list peers.
 - `allow_registration = true` (required for the token flow to
   engage). The absent
   `yes_i_am_very_very_sure_…_open_registration_…` flag keeps the
@@ -148,8 +148,8 @@ Initial rollout settings:
   homeserver admin. **The agent matrix client always supports decryption
   regardless of this flag** — it uses the `e2e-encryption` feature of
   `matrix-sdk` so it can read encrypted rooms it's invited to even when
-  this homeserver doesn't permit room encryption. Crypto keys are stored
-  in the per-agent sqlite store under the state dir and persist across
+  this homeserver doesn't permit room encryption. matrix-sdk stores
+  crypto keys in the per-agent sqlite store under the state dir; they persist across
   restarts (lost on `--purge`). `read_room` decrypts via
   `room.messages()` — UTD events surface as `event_type =
   "m.room.encrypted"` with `body = "[unable to decrypt]"`.
@@ -159,7 +159,7 @@ Initial rollout settings:
 
 ## Hive Matrix Space
 
-On first boot (after all agent accounts are provisioned), hive-c0re
+On first boot, after hive-c0re provisions all agent accounts, it
 creates a private **Matrix Space** named `"hive"` using the admin
 account (`@hive:<server_name>`) and invites every provisioned agent
 into it. This gives the operator a single Space in FluffyChat or any
@@ -174,17 +174,17 @@ restricted (any Space member including the operator can join; agents
 are explicitly invited). Room version pinned to 10 for the restricted
 join floor.
 
-**State**: both room IDs are persisted to `/var/lib/hyperhive/matrix/`
+**State**: hive-c0re persists both room IDs to `/var/lib/hyperhive/matrix/`
 (mode `0600`, owned by the hive-c0re service user):
 - `space-room-id` — the Space itself
 - `chat-room-id` — the `hive-chat` room
 
 These paths are **outside** every agent state dir and are NOT deleted by
-`nixos-container destroy --purge` — both survive full agent purges and
-are reused on re-provision.
+`nixos-container destroy --purge` — both survive full agent purges, and
+hive-c0re reuses them on re-provision.
 
-**Idempotent**: if the files exist and are non-empty, the Space and
-room are considered already created. Delete the files to force
+**Idempotent**: if the files exist and are non-empty, hive-c0re considers the Space and
+room already created. Delete the files to force
 re-creation (for example after a homeserver wipe).
 
 ## Configuration tuning
@@ -219,7 +219,7 @@ surprising behaviour:
   empty string renders `.<hive>`-shaped garbage in both nginx
   `server_name` (treated as wildcard catch-all, surprising) and
   `/etc/hosts` (invalid entry). `null` is the right opt-out shape;
-  empty string is rejected explicitly.
+  a config assertion rejects empty string explicitly.
 SSO is unconditional, so the three below are requirements of running a
 homeserver at all rather than of a setting: