docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/swarm/ui.md

@@ -23,7 +23,7 @@ reader and to a certificate — so there is no separate option to pin.
 
 > The apex must differ from `services.hyperhive.domain`. The gateway's
 > default server already answers for the hive domain, and two vhosts
-> claiming one `server_name` do not error — nginx picks one — so this is
+> claiming one `server_name` don't error — nginx picks one — so this is
 > an assertion rather than a runtime surprise.
 
 ## 🔑 You must be in the `admins` group
@@ -57,8 +57,8 @@ between "an operator's page" and "anyone with a session".
 ## What it costs to be reachable
 
 The apex is published to the hive's resolver like every other swarm
-service, so agent containers can resolve it. That is deliberate and it is
-not a hole: **reachability is not the access control here.** An agent
+service, so agent containers can resolve it. that's deliberate and it's
+not a hole: **reachability isn't the access control here.** An agent
 that resolves the name and connects still has no operator session, and
 the subrequest denies it.