docs: fix 329 Microsoft.Contractions hits with proper safety checks

Apply contraction fixes across ~40 doc files (setup, integrations, lifecycle,
networking, scheduler, swarm, tools, trust-boundary, UI, etc.). Skipped 14 hits:
- 10 where words appear in ALL CAPS for deliberate emphasis (is NOT, do NOT, etc.)
- 4 where text could not be safely located due to markdown formatting or column position

Applied via systematic scan with checks for fenced code blocks, inline code spans,
and intentional caps. Preserves sentence-initial capitalization throughout.

docs/web-ui/dashboard.md

@@ -203,7 +203,7 @@ operations: rebuilds, meta-update cascades, and first-spawns. One
 operation runs at a time; the worker drains FIFO. **Is a mounted
 `JobqGraph`** (the shared generic graph-viewer Preact component,
 `@hive/shared/jobq-graph.js` — the same one swarm-ui uses) —
-`builds.js` does not render the queue itself; it just mounts the component
+`builds.js` doesn't render the queue itself; it just mounts the component
 (`mountJobqGraph(container, props)`, since this page has no JSX
 pipeline) with an `onUpdate` callback to drive the two things below it
 that the generic view doesn't show. The component owns fetching, cold
@@ -234,7 +234,7 @@ deep-link** — the generic graph wire doesn't carry those fields, and
 rows are meant to present exactly what the endpoint provides rather
 than reconstruct chrome the backend no longer sends. Settled entries
 render their **full step tree**, not just a bare summary — the wire
-does not filter `Done` nodes out.
+doesn't filter `Done` nodes out.
 
 **State filter (hyperhive#2606).** A row of per-state checkboxes above
 the tree — one per lifecycle state, matching the row glyphs — lets the
@@ -355,7 +355,7 @@ internal failure); the page reads `detail` for display. The host coordinator per
 the agent's `matrixAccounts.<account>.tokenFile` via the same
 privileged write path as the hive-internal `matrix-token`; the token is
 **never** echoed back, and the page clears the secret inputs on submit
-regardless of outcome. The account list reflects what is *provisioned*
+regardless of outcome. The account list reflects what's *provisioned*
 (an account with a stored token), so a config-declared-but-unprovisioned
 account appears only once it has been provisioned through the form.
 
@@ -525,7 +525,7 @@ Per-schedule action column:
   (one-shots may also be paused to delay a one-time fire, so the
   button always appears). Paused rows show a `⏸ paused` badge in the
   `next` column and are sorted to the middle bucket (after active,
-  before cancelled). A paused schedule does not fire regardless of
+  before cancelled). A paused schedule doesn't fire regardless of
   `next_fire_at`; resuming (`▶`) clears the pause without adjusting
   the next-fire time. POSTs to `/api/schedules/{id}/pause` or
   `/api/schedules/{id}/resume`.
@@ -846,13 +846,13 @@ progresses (a rebuild reads `stop_for_update`, then `swap`, then
 `reconcile` rather than one constant `rebuilding` for its whole
 life). Two consequences for anything rendering it:
 
-- The label vocabulary is **open** — it is the node's own wire tag
+- The label vocabulary is **open** — it's the node's own wire tag
   (`NodeKind::as_str`, the same strings the graph wire's node
   labels carry), not a fixed set. Treat it as an opaque display
-  string; do not switch on specific values. `restarting` in
+  string; don't switch on specific values. `restarting` in
   particular no longer exists, because no node kind is unique to a
   restart.
-- It is **not** exclusively operator-initiated, and **not** limited
+- it's **not** exclusively operator-initiated, and **not** limited
   to rebuild-shaped work — `running_transients()` on the backend is
   a status-only test (any `Running` node whose payload names a
   non-empty agent lights a pill), so work the operator never
@@ -1135,7 +1135,7 @@ below — some endpoints aren't in it yet.
   Refuses `Running` / terminal-state entries (in-flight
   rebuilds can't be safely interrupted). Always 200; body is
   `{"cancelled": true}` on a successful flip or
-  `{"cancelled": false}` when the entry was not in `Queued` state.
+  `{"cancelled": false}` when the entry wasn't in `Queued` state.
 - `POST /api/agent/{name}/mark-all-read` — ack all pending broker
   messages for `{name}`. Backfills `delivered_at` for rows
   not yet delivered and sets `acked_at = now`. Returns
@@ -1287,7 +1287,7 @@ below — some endpoints aren't in it yet.
   the audit trail distinguishes scheduled fires from operator-
   triggered ones.
 - `POST /api/schedules/{id}/pause` — pause a recurring or
-  one-shot schedule. A paused schedule does not fire regardless
+  one-shot schedule. A paused schedule doesn't fire regardless
   of `next_fire_at`; the row gains a `⏸ paused` badge.
 - `POST /api/schedules/{id}/resume` — resume a paused schedule.
   Clears the pause flag without adjusting `next_fire_at`.

docs/web-ui/shape.md

@@ -225,7 +225,7 @@ returns inside the builder still commit whatever was appended
 before they returned.
 
 **Keyed DOM caching:** for sections whose rows hold interactive state
-(textarea drafts, checkboxes, focused inputs) `paintAtomic` is not
+(textarea drafts, checkboxes, focused inputs) `paintAtomic` isn't
 enough — wiping and rebuilding still destroys the state even if the
 flash is hidden. The keyed pattern keeps a `Map<id, {el, fingerprint}>`
 where the fingerprint is `JSON.stringify({...visible fields...})`.
@@ -234,7 +234,7 @@ textarea draft, checkbox state, and event listeners); only cache-miss
 rows are rebuilt and inserted. Used for: containers (`containerRowCache`),
 rebuild-queue entries (`rebuildQueueRowCache`). The spawn-form input+focus and meta-input
 checkboxes use a lighter snapshot-then-restore pattern (snapshot
-before `replaceChildren`, restore after) since they are single
+before `replaceChildren`, restore after) since they're single
 values rather than per-row caches.
 
 **`<details>` open-state preservation:** any collapsible element