docs: drop redundant hyphens from -ly adverb + adjective/participle compounds

Fixes 22 of 23 Microsoft.Hyphens hits: an adverb ending in -ly doesn't
need a hyphen to the word it modifies (minimally scoped, currently
running, deliberately stopped, ...) -- the -ly ending already
unambiguously signals it's modifying the following word, so the
hyphen is redundant per Microsoft style.

Left one hit alone: docs/web-ui/dashboard.md's 'checked-not-originally-
active' is a single 4-word compound designator (parallel structure
with 'unchecked-was-active' right before it in the same sentence,
describing a diffing algorithm's two possible states), not an
ordinary -ly-adverb modifier -- dropping just the one hyphen vale
flagged would have broken the compound into a dangling
'checked-not-originally active' fragment. Also rewrote
docs/scheduler/coordinator.md's 'still-fully-queued' as a predicate
('DAGs that are still fully queued') rather than leaving a similar
broken partial-hyphen chain, since 'still' and 'fully' are both plain
adverbs with no reason to hyphenate at all once dehyphenated
consistently.

Verified via vale: only the one deliberately-left hit remains.

docs/trust-boundary/security.md

@@ -91,7 +91,7 @@ handed it.
 hyperhive provisions and scopes its **own** per-agent forge + matrix tokens.
 It does **not** automatically sandbox or scope **external** credentials
 (GitHub PATs, cloud keys, third-party API tokens). The scope of an external
-token is **operator-accepted risk**: if you drop a broadly-scoped GitHub token
+token is **operator-accepted risk**: if you drop a broadly scoped GitHub token
 into an agent's config, that agent has exactly that reach, with no hyperhive
 layer narrowing it. Scope external tokens tightly at the source (the external
 provider) before handing them over.