docs: fix genuine Microsoft.Contractions/Negative errors

16 of the 23 error-level hits from a full-repo vale run were real:
'is/are/does/do NOT' and bold 'not' expanded per Microsoft.Contractions,
one hyphen-as-negative-number fixed to an en dash per Microsoft.Negative
(docs/web-ui/dashboard.md's -45 deg column-header tilt).

Where the caps/bold was there for emphasis (contrasting X does this,
Y does not), kept the emphasis by bolding the contraction rather than
dropping it silently -- 'is not' -> 'isn't', 'does NOT' -> '**doesn't**',
etc.

docs/tools/swarmctl-cli.md's one genuine hit is generated -- fixed the
source doc comment in swarmctl/src/main.rs and regenerated via
'cargo run --bin swarmctl -- markdown-docs', diffed against the old
copy first to confirm only the intended line changed.

Left 7 hits unfixed, false positives from the rule matching a
substring rather than the actual pattern it names:
- 4x 'that's instead of that is': every one is the explanatory 'that
  is' idiom (~= i.e.), not a contractible subject+verb -- 'that's'
  would misparse as a demonstrative-pronoun contraction and change the
  sentence's meaning. docs/integrations/forge.md:282,
  docs/tools/forge.md:260, docs/tools/hivectl.md:243,
  docs/web-ui/dashboard.md:457 (and the swarmctl-cli.md generated
  twin of the same category, source left alone for the same reason).
- docs/agent-lifecycle/persistence.md:482 -- 'is not' matched inside
  'is nothing' (the same has-not/has-nothing substring trap noted
  before in this doc's own git history).
- docs/swarm/ca.md:182 -- 'it is' matched inside the already-correct
  'it isn't'.

Per #4128. Remaining errors on main after this: Microsoft.Avoid's 26
hits, already tracked + awaiting a house-style ruling on #4041.

docs/scheduler/ci.md

@@ -180,7 +180,7 @@ A malicious `default.nix` or build script in a PR can therefore:
 - **Make arbitrary network requests** to any address reachable from the container. The container runs in its own netns behind the hive bridge, so it reaches the forge only through the gateway (`http://<forge.domain>`, public/read endpoints — no admin credentials) and **can't** reach host-loopback services: the unauthenticated core dashboard at `127.0.0.1:7000` and the raw forge port are off-limits (bridge→127.0.0.0/8 is dropped).
 - **Write to the container filesystem**, including corrupting the runner's state dir or `.runner` credentials.
 
-The core admin token (`forge-core-token`) is **not** bind-mounted into the container. it's held and used only by hive-c0re on the host (`forge/ci_runner.rs`), which mints per-runner registration tokens; only that registration token reaches the container's env-file. A build process can still reach forge over the network, but can't use the admin token to issue privileged API calls.
+The core admin token (`forge-core-token`) **isn't** bind-mounted into the container. it's held and used only by hive-c0re on the host (`forge/ci_runner.rs`), which mints per-runner registration tokens; only that registration token reaches the container's env-file. A build process can still reach forge over the network, but can't use the admin token to issue privileged API calls.
 
 Note: `nix flake check --no-build` (eval-only) reduces the attack surface but doesn't eliminate it — `builtins.fetchGit`, `builtins.fetchurl`, and import-from-derivation can reach the network and filesystem during evaluation. The default CI workflow runs full `nix flake check` (builds derivations), which is the higher-risk path.
 
@@ -214,7 +214,7 @@ following to your host config:
   #
   # `randomizedDelaySec` because a fixed daily time lands on the same wall
   # clock as whatever else runs nightly. A collection that overlaps a CI
-  # job does not fail it — the runner builds through the host nix-daemon,
+  # job doesn't fail it — the runner builds through the host nix-daemon,
   # so an in-flight build's temp roots are protected — but the first build
   # after a collection rebuilds what the collection deleted, so a run that
   # lands just behind one pays for it in wall time.