docs: fix genuine passive-voice hits in docs/trust-boundary

Third batch of hyperhive#4042's Passive pass (see #4098/#4099 for the
first two and the read-every-hit discipline this pass uses). 23 hits
across boundary.md (10) and security.md (13).

boundary.md, 2 of 10 rewritten:
- "Operator-authority actions ... are served by the core daemon and
  only reachable via the gateway" -> "The core daemon serves
  operator-authority actions ..., reachable only via the gateway" --
  the actor was already named in the sentence, and the parallel
  "Agent" bullet right below it is already active voice ("speaks only
  for itself"), so the Operator bullet was the inconsistent one.
- "ownership set afterwards is reverted the next time any agent
  changes" -> "and reverts any ownership set afterwards the next time
  any agent changes" -- continues the same subject ("the `d`
  re-applies ... and reverts ...") already established one clause
  earlier, avoiding a subject switch entirely.

security.md, 6 of 13 rewritten (across 3 edits touching 6 flagged
locations):
- "A compromised/confused agent's reach ... is bounded by its own
  account's scope" -> "Its own account's scope bounds a
  compromised/confused agent's reach" -- matches the section's own
  header ("Scoped tokens bound the blast radius"), which is already
  active voice.
- "Two allow-listed root prefixes are accepted; all other paths are
  rejected" -> "It accepts two allow-listed root prefixes and rejects
  all other paths" -- continues "it" from the endpoint named one
  sentence earlier.
- The container-allowlist paragraph (3 flagged locations: "is
  validated", "are accepted", "are rejected") rewritten as one
  consistent-subject passage with `hive-priv` as the actor throughout,
  matching the neighboring bullets in the same subsection
  ("**Socket-activated** -- systemd starts hive-priv...", already
  active voice) -- the passive version was the odd one out among
  siblings, not the house style.

15 of 23 hits left alone. The recurring legitimate shapes, same
categories as #4098: predicate-adjective copulas that only look like
passives ("an agent is trusted code", "the agent is privileged" --
"trusted"/"privileged" modify the noun, there's no actor to name),
quoted rhetorical contrasts where the passive is doing real work (a
"wrong-framing" quote left passive on purpose, paired with an active
"right-framing" quote right after it), the "is tracked as/in X"
idiom (twice, same as #4098's precedent), and "X can't be Yed" /
negative-capability invariant statements (matches #4098's "No X is Y"
security-guarantee idiom). One deliberately left despite a nameable
antecedent ("hive-gateway's access is scoped [by ReloadGatewayNginx]
instead") -- lower-confidence rewrite than the others, left rather
than force it.

Verified: vale docs/trust-boundary before/after -- 23 -> 15
write-good.Passive hits, exactly the 8 rewritten, no other rule's hit
count moved (the TooWordy/Microsoft.Avoid/alex hits vale also reports
on these two files are pre-existing and out of scope for a
Passive-only pass; TooWordy's hits specifically already have a fix
queued in #4097, not duplicated here).

docs/trust-boundary/boundary.md

@@ -14,9 +14,9 @@ always on), the gateway proxies all operator-facing traffic, and
 
 - **Operator** — reaches every UI (the dashboard + every
   per-agent page) through the gateway, on one origin.
-  Operator-authority actions (approve / deny, answer-as-operator,
-  lifecycle POSTs) are served by the core daemon and only
-  reachable via the gateway.
+  The core daemon serves operator-authority actions (approve / deny,
+  answer-as-operator, lifecycle POSTs), reachable only via the
+  gateway.
 - **Agent** — speaks only for itself, only over its per-agent
   unix socket. The socket's identity _is_ the agent (see
   `docs/process/conventions.md`, "identity = socket"). An agent must not
@@ -112,8 +112,8 @@ both sockets are `0666`, which is all a dialer needs.
 **Ownership is declared, not repaired.** The tmpfiles.d entry written by
 `SyncAgentTmpfiles` names the uid/gid directly. Don't add a chown
 alongside it: `d` re-applies on every boot _and_ every agent
-spawn/destroy, so ownership set afterwards is reverted the next time any
-agent changes — which is exactly how this dir spent a long time at
+spawn/destroy, and reverts any ownership set afterwards the next time
+any agent changes — which is exactly how this dir spent a long time at
 `0777 root root` while a privileged chown appeared to be fixing it.
 
 The mode is load-bearing, not cosmetic. Write permission on a