docs: clear write-good.Passive hits in matrix/persistence docs

Part of #4548 — second batch. This PR: docs/integrations/matrix.md
(18 hits), docs/agent-lifecycle/persistence.md (17 hits) = 35 more of
the 353 (99 total across the two PRs so far).

Same method as the first batch (#4551): minimal, meaning-preserving
active-voice rewrites only, no restructuring beyond what each flagged
sentence needed, no vale-off silencing.

Genuine false positives left in place, with per-file reasoning in the
PR body: predicate-adjective state descriptions ("is wedged", "is
stopped", "are unrelated", "is unaffected", "is needed"), one
design-intent idiom ("was meant to prevent" — same shape as earlier
docs-lint work), and one vale parsing artifact: "is read" flagged
inside the hyphenated compound adjective "read-only", not real passive
voice at all.

docs/integrations/matrix.md

@@ -31,7 +31,7 @@ Two distinct hostnames:
 
 - **`serverName`** — matrix-spec `server_name`, embedded
   *irrevocably* in every `@user:<server_name>` and `!room:<server_name>`
-  identifier minted on this homeserver. can't be changed later
+  identifier minted on this homeserver. You can't change it later
   without abandoning every account and chat history. Defaults to the
   bare `services.hyperhive.swarm.domain`; clients autodiscover the
   actual API endpoint via the `.well-known/matrix/{client,server}`
@@ -73,7 +73,7 @@ A rebuild on a host that already has a homeserver prints a
 `hive-matrix: WARNING — … serverName is unset` line when this is missing,
 naming the value it's about to default to. That warning is why this
 section exists; it never fails the rebuild, so it's on you to act on it
-before the ids are minted.
+before the homeserver mints the ids.
 
 ## Default-closed firewall
 
@@ -92,8 +92,8 @@ delegation (the latter lives in `gateway.md::Discovery flow`).
 
 ## Provisioning flow (appservice)
 
-Registration is closed. Accounts are created by the hive's own
-**appservice**: hive-c0re holds the appservice token, agents never see
+Registration is closed. The hive's own **appservice** creates accounts:
+hive-c0re holds the appservice token, agents never see
 it, and an agent only ever receives its own `access_token`.
 
 The appservice has no URL (`url: null` in its registration), so the
@@ -108,7 +108,7 @@ a token.
    spec-required `hs_token` sibling, mode `0600 root:root`, then renders
    the registration to
    `/var/lib/hyperhive/matrix-appservice/hyperhive.yaml` (also `0600`).
-   The tokens are minted only when missing; the registration is
+   hive-c0re mints the tokens only when missing; the registration is
    re-rendered every time, because the token file can be overwritten in
    place by the swarm secret store and a registration naming a stale
    token authenticates nobody. Runs at activation time, before any
@@ -156,12 +156,12 @@ and likewise before the listener — so a fresh hive has a joined,
 power-level-100 admin on its first boot.
 
 This replaces a dependency on being the first account ever registered,
-which was fragile in both directions: an appservice-created account is
-excluded from that automatic grant by design, and on a homeserver that
+which was fragile in both directions: the design excludes an
+appservice-created account from that automatic grant, and on a homeserver that
 already had users the rule never fired at all.
 
-Promotion can't be bootstrapped over the API, and that's upstream's
-design rather than a gap: tuwunel only treats an admin-room message as a
+Tuwunel doesn't support bootstrapping promotion over the API, and
+that's upstream's design rather than a gap: it only treats an admin-room message as a
 command when its sender is already an admin. `admin_execute` is the one
 lever with no sender to check. hive-c0re re-checks the result on every
 sweep by reading the admin account's own joined-rooms list; if the rights
@@ -179,14 +179,14 @@ restarts, so the first boot after the switch already has both halves.
   device that minted it; removing the registration token touches no
   device, no account and no session. `login_with_password` stays on, so
   the password fallback is still there too.
-- **Existing token files are honoured.** The per-agent sweep skips any
-  agent that already has a `matrix-token`, so no account is re-registered
-  and no session is displaced.
+- **The per-agent sweep honours existing token files.** It skips any
+  agent that already has a `matrix-token`, so it re-registers no account
+  and displaces no session.
 - **The admin account is already admin** on such a hive (it won the
   first-user grant when the hive was new), so the startup promotion is a
   no-op — upstream's `make_user_admin` short-circuits when the user is
   already joined at power level 100.
-- **`/var/lib/hyperhive/matrix-register-token` is left on disk**, read by
+- **`/var/lib/hyperhive/matrix-register-token` stays on disk**, read by
   nothing. Delete it or leave it; neither does any harm.
 - **`registrationTokenFile` is a removed option.** A config that still
   sets it fails to evaluate with a message naming the appservice — a hive
@@ -209,7 +209,7 @@ Initial rollout settings:
   until you list peers.
 - `allow_registration = false`. tuwunel checks this flag only for
   requests that arrive **without** an appservice token, so hive-c0re
-  provisions exactly as before and everyone else is refused. It's not a
+  provisions exactly as before and tuwunel refuses everyone else. It's not a
   hardening afterthought: with no registration token configured,
   `allow_registration = true` makes tuwunel refuse to start unless
   `yes_i_am_very_very_sure_…_open_registration_…` is also set.
@@ -272,7 +272,7 @@ services.hyperhive.swarm.matrix = {
 **`trustedServers`** (default `[]`) — list of peer homeserver names
 whose signing keys tuwunel will fetch and trust. Federation is enabled
 at the protocol level from first boot (`allow_federation = true`) but
-no remote homeserver is trusted until listed here. For a closed
+tuwunel trusts no remote homeserver until you list it here. For a closed
 single-hive deployment the default empty list is correct — add peer
 hive domains here when connecting hives into a swarm (see
 [`docs/swarm/`](../swarm/README.md)).