docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/process/gotchas.md

@@ -138,7 +138,7 @@ reference-less `-source` (so the runtime closure never arrives), and
 pure evaluation rejects. `hyperhive.docs.source` gets away with being
 an input only because a docs tree has no runtime dependencies.
 
-The `storePath` trap is worth spelling out, because it is not confined
+The `storePath` trap is worth spelling out, because it's not confined
 to options the operator writes: **any** option of type `package` fed a
 store-path _string_ coerces through `lib.toDerivation`, i.e.
 `builtins.storePath`. `environment.systemPackages` and
@@ -150,7 +150,7 @@ farm built from the interpolated string — before it can go anywhere a
 package is expected.
 
 The catch is that a path written into a generated flake is text, not a
-reference — the container's closure does not keep the binary alive.
+reference — the container's closure doesn't keep the binary alive.
 The **host** does: the package is interpolated into
 `/etc/hyperhive/serve.json`, so it lands in the host's system closure
 and is gc-rooted by the running generation. `builtins.toJSON` preserves
@@ -257,7 +257,7 @@ store files. Any subsequent write into the copied tree (adding new
 files in subdirectories) fails with `EPERM`. Fix: pass
 `--no-preserve=mode,ownership` so the output tree is writable.
 
-### `nix build flake#name` does not walk into `nixosConfigurations`
+### `nix build flake#name` doesn't walk into `nixosConfigurations`
 
 `nix build` resolves the fragment (`#name`) against the flake's
 **top-level output attrs** — not against `nixosConfigurations`
@@ -339,7 +339,7 @@ error: getting Git object '<hash>': object not found (libgit2 error code = 9)
 
 when a commit that was reachable at some earlier evaluation is now gone
 (GC'd, rebased away, or pruned). The failure is persistent: clearing
-`~/.cache/nix/{eval-cache-v6,gitv3,fetcher-cache-v4.sqlite}` does not
+`~/.cache/nix/{eval-cache-v6,gitv3,fetcher-cache-v4.sqlite}` doesn't
 help because the missing object is a structural gap in the git object
 graph itself, not in nix's caches.
 
@@ -410,7 +410,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   and `XDG_RUNTIME_DIR=/run/gui` as global system environment
   variables (gated on `hyperhive.gui.enable`) so every systemd service
   in the container inherits them. Without this, services starting
-  Wayland clients could not find the compositor — libwayland falls
+  Wayland clients couldn't find the compositor — libwayland falls
   back to a headless display or errors out, the app "works" on a
   second invisible display, and the VNC session shows a blank weston
   desktop (#540 double-screen).
@@ -432,7 +432,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
 - **`Type = "simple"` (not `notify`)**: `switch-to-configuration`
   must never block on weston signalling readiness. A misconfigured
   weston degrades to a `Restart=on-failure` loop visible in
-  `journalctl`, it does not abort the `nixos-container update`.
+  `journalctl`, it doesn't abort the `nixos-container update`.
   Same reasoning as the `tea-login` unit in `nix/agent-modules/forge.nix`.
 - **`[core] idle-time=0`**: disables weston's 300-second idle
   timeout. Without it the VNC desktop fades to black and