docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/networking/snapshot-store.md

@@ -4,14 +4,14 @@ The swarm's `btrfs receive` endpoint. Hives push agent snapshots to it
 over the WireGuard mesh; a destination hive later pulls one back to
 complete a migration.
 
-Two things it is not, both worth stating because both are common
+Two things it's not, both worth stating because both are common
 assumptions:
 
-- **It is not the swarm controller**, and does not depend on one. It is
+- **it's not the swarm controller**, and doesn't depend on one. it's
   a NixOS host role: a btrfs subvolume tree, a socket-activated
   receiver, and the `wg-hive` interface the swarm module already brings
-  up. That is why it can be deployed before any controller exists.
-- **It is not a backup product.** It happens to hold the data a backup
+  up. that's why it can be deployed before any controller exists.
+- **it's not a backup product.** It happens to hold the data a backup
   would hold, and it should be operated accordingly (see
   [Operating it](#operating-it)) --- but nothing in it does scheduling,
   verification, or restore orchestration.
@@ -56,15 +56,15 @@ services.hyperhive.swarm.snapshotStore = {
 Two deliberate asymmetries in that pair, both liable to be misread as
 inconsistency:
 
-- **`address` has no default.** It is a deployment fact a pushing hive
-  cannot derive, and a wrong guess means streaming an agent's state at
+- **`address` has no default.** it's a deployment fact a pushing hive
+  can't derive, and a wrong guess means streaming an agent's state at
   whatever happens to answer. Unset, a push fails naming this option.
-- **`port` does default** (`51821`), because it is a convention both
+- **`port` does default** (`51821`), because it's a convention both
   ends read from the same option docs --- a default there is
   coordination, not a guess.
 
 Note the option lives under `swarm.*` while the receiving host's lives
-under `services.hyperhive.snapshotStore`. That is the distinction the
+under `services.hyperhive.snapshotStore`. that's the distinction the
 two namespaces carry throughout: `swarm.*` describes _the swarm_ as seen
 from this host, and a bare `services.hyperhive.<service>` describes _a
 role this host performs_. A store host sets both --- one to run the
@@ -78,7 +78,7 @@ and no credential argument, because the mesh is the authentication.
 
 ## The mesh is the authentication
 
-There are no certificates here, and no key material of its own. That is
+There are no certificates here, and no key material of its own. that's
 deliberate rather than an omission.
 
 WireGuard's cryptokey routing already binds a peer's source address to
@@ -97,16 +97,16 @@ you need to move an agent.
 
 The destination is keyed by **agent**.
 
-This is not cosmetic. After a migration, an agent's next incremental
+This isn't cosmetic. After a migration, an agent's next incremental
 send arrives from a _different_ hive than the previous one. Keying by
 hive would split that agent's snapshot chain across two directories,
 and `btrfs send -p` would fail to find its parent --- breaking exactly
 the case the store exists to serve.
 
-## What the sender can and cannot choose
+## What the sender can and can't choose
 
 A `btrfs send` stream carries no notion of _which agent_ it belongs to,
-and the subvolume name inside it is chosen by the sender. So the
+and the subvolume name inside it's chosen by the sender. So the
 protocol is one `agent <name>` header line, then the raw stream.
 
 The rule that matters:
@@ -116,7 +116,7 @@ The rule that matters:
 
 Validation is an allowlist --- `[A-Za-z0-9_-]+` and nothing else. No
 slash and no dot means neither directory traversal nor an absolute path
-can survive it. It is deliberately an allowlist and not a list of
+can survive it. it's deliberately an allowlist and not a list of
 forbidden characters: a blocklist only ever excludes the attacks
 somebody already thought of.
 
@@ -128,7 +128,7 @@ address being set are assertions, not documentation --- bound to
 `0.0.0.0` this socket is an unauthenticated remote write into agent
 state.
 
-Binding is not sufficient on its own. NixOS's firewall is default-deny
+Binding isn't sufficient on its own. NixOS's firewall is default-deny
 and filters in netfilter, _before_ a packet reaches a bound socket, so
 the port is opened explicitly --- and scoped to the mesh interface:
 
@@ -165,7 +165,7 @@ nobody runs it day to day, so it rots and is discovered broken in
 production.
 
 ⚠️ **The assumption to keep true over time:** the store host runs
-nothing else. That is true on day one and quietly false the day someone
+nothing else. that's true on day one and quietly false the day someone
 notices the box has spare disk. Nothing in the config objects when it
 stops being true.
 
@@ -207,7 +207,7 @@ periodically), not here. Count rather than age is deliberate: a count
 is bounded by construction, whereas an age policy silently scales disk
 usage with how hot a hive runs.
 
-Per-agent or per-hive `btrfs qgroup` quotas are not configured yet.
+Per-agent or per-hive `btrfs qgroup` quotas aren't configured yet.
 Without them one runaway hive can fill the store and take out every
 other hive's snapshots.