docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/process/conventions.md

@@ -126,7 +126,7 @@ request still carries an optional `wait_seconds` (long-poll the first
 message, once one arrives — or one is already pending — the call
 drains up to `max` in total): the harness's own turn-driving loop
 uses it internally (`hive-agent`'s `recv_next`, 180s). The
-agent-facing MCP `recv` tool does not expose this parameter — it
+agent-facing MCP `recv` tool doesn't expose this parameter — it
 always passes `wait_seconds: None`, an immediate peek.
 
 Per-row bookkeeping inside the broker:
@@ -484,7 +484,7 @@ must be *fixed*, not silenced. Common patterns:
 If a lint seems wrong for a specific call site, file an issue and ask
 mara — don't add `#[allow]` speculatively. The gate is intentional.
 
-**The devshell checks are not the full `nix flake check`.** Clippy /
+**The devshell checks aren't the full `nix flake check`.** Clippy /
 fmt / `cargo test` cover most gates, but `nix flake check` runs extra
 check derivations they don't:
 
@@ -535,7 +535,7 @@ Shape contract — every one of these:
 1. **Always `exit 0`**, even on internal failure. A non-zero exit
    would mark the unit `failed`, which in turn aborts
    `nixos-container update` and blocks rebuilds. The agent's
-   capability surface is not allowed to gate the container
+   capability surface isn't allowed to gate the container
    build.
 2. **No `set -e`** in the script body. Subshell failures must not
    propagate. Use `... || true` on every external call that can

docs/process/gotchas.md

@@ -138,7 +138,7 @@ reference-less `-source` (so the runtime closure never arrives), and
 pure evaluation rejects. `hyperhive.docs.source` gets away with being
 an input only because a docs tree has no runtime dependencies.
 
-The `storePath` trap is worth spelling out, because it is not confined
+The `storePath` trap is worth spelling out, because it's not confined
 to options the operator writes: **any** option of type `package` fed a
 store-path _string_ coerces through `lib.toDerivation`, i.e.
 `builtins.storePath`. `environment.systemPackages` and
@@ -150,7 +150,7 @@ farm built from the interpolated string — before it can go anywhere a
 package is expected.
 
 The catch is that a path written into a generated flake is text, not a
-reference — the container's closure does not keep the binary alive.
+reference — the container's closure doesn't keep the binary alive.
 The **host** does: the package is interpolated into
 `/etc/hyperhive/serve.json`, so it lands in the host's system closure
 and is gc-rooted by the running generation. `builtins.toJSON` preserves
@@ -257,7 +257,7 @@ store files. Any subsequent write into the copied tree (adding new
 files in subdirectories) fails with `EPERM`. Fix: pass
 `--no-preserve=mode,ownership` so the output tree is writable.
 
-### `nix build flake#name` does not walk into `nixosConfigurations`
+### `nix build flake#name` doesn't walk into `nixosConfigurations`
 
 `nix build` resolves the fragment (`#name`) against the flake's
 **top-level output attrs** — not against `nixosConfigurations`
@@ -339,7 +339,7 @@ error: getting Git object '<hash>': object not found (libgit2 error code = 9)
 
 when a commit that was reachable at some earlier evaluation is now gone
 (GC'd, rebased away, or pruned). The failure is persistent: clearing
-`~/.cache/nix/{eval-cache-v6,gitv3,fetcher-cache-v4.sqlite}` does not
+`~/.cache/nix/{eval-cache-v6,gitv3,fetcher-cache-v4.sqlite}` doesn't
 help because the missing object is a structural gap in the git object
 graph itself, not in nix's caches.
 
@@ -410,7 +410,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   and `XDG_RUNTIME_DIR=/run/gui` as global system environment
   variables (gated on `hyperhive.gui.enable`) so every systemd service
   in the container inherits them. Without this, services starting
-  Wayland clients could not find the compositor — libwayland falls
+  Wayland clients couldn't find the compositor — libwayland falls
   back to a headless display or errors out, the app "works" on a
   second invisible display, and the VNC session shows a blank weston
   desktop (#540 double-screen).
@@ -432,7 +432,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
 - **`Type = "simple"` (not `notify`)**: `switch-to-configuration`
   must never block on weston signalling readiness. A misconfigured
   weston degrades to a `Restart=on-failure` loop visible in
-  `journalctl`, it does not abort the `nixos-container update`.
+  `journalctl`, it doesn't abort the `nixos-container update`.
   Same reasoning as the `tea-login` unit in `nix/agent-modules/forge.nix`.
 - **`[core] idle-time=0`**: disables weston's 300-second idle
   timeout. Without it the VNC desktop fades to black and