docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/trust-boundary/boundary.md

@@ -55,7 +55,7 @@ gateway, which fronts all operator traffic and is where operator auth lives,
 and (b) network isolation, which keeps agents — and `hive-ci`'s untrusted PR
 builds — off host-loopback so nothing can reach `127.0.0.1:<dashboard_port>`
 directly. This is deliberate given the load-bearing role of network isolation
-above, but it is a standing invariant: the `/api` must never be bound to a
+above, but it's a standing invariant: the `/api` must never be bound to a
 non-loopback address or exposed outside the gateway, and every new
 operator-authority route inherits that assumption. `hive-ci` is treated like an
 agent for this purpose — it runs untrusted PR code and is netns-isolated for
@@ -97,7 +97,7 @@ exact same path, so the group grant always holds.
 ### the per-agent socket dir
 
 `/run/hive-agent/<name>/` is shared by **three principals that share no
-group**, which is why its mode is what it is:
+group**, which is why its mode is what it's:
 
 | principal           | reaches                                  | needs        |
 | ------------------- | ---------------------------------------- | ------------ |
@@ -110,7 +110,7 @@ agent's container uid/gid** — `o=--x` is traverse without listing, and
 both sockets are `0666`, which is all a dialer needs.
 
 **Ownership is declared, not repaired.** The tmpfiles.d entry written by
-`SyncAgentTmpfiles` names the uid/gid directly. Do not add a chown
+`SyncAgentTmpfiles` names the uid/gid directly. don't add a chown
 alongside it: `d` re-applies on every boot _and_ every agent
 spawn/destroy, so ownership set afterwards is reverted the next time any
 agent changes — which is exactly how this dir spent a long time at
@@ -119,7 +119,7 @@ agent changes — which is exactly how this dir spent a long time at
 The mode is load-bearing, not cosmetic. Write permission on a
 _directory_ is what confers the right to unlink its entries, whoever owns
 them, and the sticky bit is the only thing that would restrain that (it
-is not set here). A world-writable socket dir therefore lets anything
+isn't set here). A world-writable socket dir therefore lets anything
 able to reach the path delete an agent's socket and bind its own — and
 nginx reaches all of `/run/hive-agent` as a plain host path. Dropping
 `o=w` removes that permission rather than qualifying it.
@@ -142,11 +142,11 @@ This dir has exactly one writer, so it needs no world write at all.
 `hivectl` drives the whole hive — spawn / kill / destroy / rebuild /
 deploy — over the **host admin socket** `/run/hyperhive/host.sock`,
 socket-activated by the `hive-c0re.socket` unit. That socket _is_ the
-full-control surface, so who can connect to it is a real trust
+full-control surface, so who can connect to it's a real trust
 boundary.
 
 By default the socket is `0660` group-owned by **`hive-admin`**, an
-empty group — so it is effectively **root-only** until an operator is
+empty group — so it's effectively **root-only** until an operator is
 explicitly granted access. Grant sudoless `hivectl` by listing login
 users in `services.hyperhive.c0re.adminUsers`; each is added to
 `hive-admin`, and members connect without `sudo`. The runtime dir