docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/turn-loop/README.md

@@ -109,7 +109,7 @@ user-configured MCP server can push its own todos the same way. See
 what each built-in todo producer watches and how the store + `get_loose_ends`
 merge work.
 
-Plugin install failures are not fatal: each entry comes back as a
+Plugin install failures aren't fatal: each entry comes back as a
 human-readable failure string that gets routed via
 `Surface::send_to_parent` to the agent's topology parent (the
 broker resolves `<parent>` per `topology::resolve_recipient`; root

docs/turn-loop/config.md

@@ -119,7 +119,7 @@ Constraints: `target` must start with an alphanumeric or `_` and
 contain only alphanumerics, `_`, `.`, `/`, `-`. `..` segments are
 rejected by a config assertion. The merge step refuses to overwrite
 files already present in the default dist — pick a target name that
-does not collide with existing paths (`static/`, `index.html`, etc.).
+doesn't collide with existing paths (`static/`, `index.html`, etc.).
 
 The default dist ships at `hyperhive.frontend.dist` (the
 `hyperhive-frontend` package output, read-only). To replace the
@@ -150,8 +150,8 @@ loopback default would only ever be correct when the forge shares the
 agent's network namespace, and inside a container `localhost` is the
 agent itself, so the default was a value that built fine and then talked
 to the wrong machine. With `null` the `tea-login` and `forge-avatar-sync`
-units are not generated at all: an absent integration rather than a
-misdirected one. You do not normally set this — hive-c0re renders the
+units aren't generated at all: an absent integration rather than a
+misdirected one. You don't normally set this — hive-c0re renders the
 host's real forge URL into every agent, and refuses to write a meta
 flake without one, so `null` only survives where the agent modules are
 evaluated outside a hive.
@@ -201,14 +201,14 @@ hyperhive.claudePluginsAutoUpdate = false;               # default
 - **`claudePlugins`** — list of plugin specs passed to
   `claude plugin install <spec>`. Each spec is installed on every boot
   (`install` is expected to be idempotent); failures log a warning but
-  do not abort boot. Defaults to Anthropic's `skill-creator` (so every
+  don't abort boot. Defaults to Anthropic's `skill-creator` (so every
   agent can author, refine, and evaluate its own skills) plus
   hyperhive's own `base` plugin — skills that apply to every agent
   regardless of role (currently just `state-hygiene`) — all without
   any per-agent wiring.
 
 > Both plugin lists follow ordinary NixOS list-option semantics: a
-> per-agent definition **replaces** the default, it does not extend it.
+> per-agent definition **replaces** the default, it doesn't extend it.
 > An agent that sets `claudePlugins` and still wants the defaults has
 > to list `skill-creator@claude-plugins-official` and `base@hyperhive`
 > explicitly alongside its own entries — likewise for the two default
@@ -238,7 +238,7 @@ Non-compile subcommands (`new`, `add`, third-party `cargo-*`) are
 left untouched.
 
 Set to `false` for agents that parse cargo's JSON output
-programmatically and do not pass `--message-format json` themselves.
+programmatically and don't pass `--message-format json` themselves.
 
 ## API-key backend (`useApiKey` / `backendEnvironmentFile`)
 
@@ -288,7 +288,7 @@ The file lives in the agent's bind-mounted **harness** dir, not `state/`
 (see `docs/agent-lifecycle/persistence.md`'s "Parent access to child state"), so an API
 key placed here is reachable by nothing but this agent and the host.
 
-⚠️ Verified end-to-end against OpenRouter has not happened as of this
+⚠️ Verified end-to-end against OpenRouter hasn't happened as of this
 writing — `ANTHROPIC_BASE_URL` support in the shipped Claude CLI is
 documented behavior, not something this hive has run a live turn
 against yet. Tool use, streaming, and MCP all need to keep working

docs/turn-loop/mcp.md

@@ -83,7 +83,7 @@ at_unix_timestamp?)`.
   `cancel_loose_end`. Omit `agent` to list your own threads. Pass
   `agent: "<name>"` to inspect a direct child agent (always accessible
   per topology enforcement); non-children require the
-  `query_agent_state` capability. The `"*"` hive-wide query is not
+  `query_agent_state` capability. The `"*"` hive-wide query isn't
   available on the agent socket.
 - `cancel_loose_end` — hard-delete a `reminder`, cancel a pending
   `approval` row, or clear a `todo` row (loose-ends-v2). Agents may
@@ -139,7 +139,7 @@ hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
   disabled for agents). The repo is created in the c0re-owned `agents`
   org; the calling agent gets write collaborator access; the default
   branch is branch-protected (operator-team must approve merges, so the
-  agent cannot self-merge). Opt-in; not in any default preset.
+  agent can't self-merge). Opt-in; not in any default preset.
   See [`docs/tools/forge.md — Repo management`](../tools/forge.md).
 - **Web egress** (`web_tools`) — enables Claude's built-in `WebFetch`
   and `WebSearch` tools (not MCP tools; added directly to the