matrix, docs: drop the last admin framing, fix tense and prose lint

Three leftovers from the rename, plus the gating prose job.

`nix/packages/default.nix` still described the minter as the "matrix
admin credential's minter", and shipped that claim in the package's
`meta.description` — a PR-visible string.

`promote_user_to_admin`'s doc comment pointed at the `admin_execute`
entry in `hive-matrix.nix` as the thing that bootstraps the first
admin. That entry is gone, so the comment referenced nothing. It now
records that the account is ordinary, that the call therefore has no
working sender, and that rehoming at swarm level is the fix rather than
re-granting. `reset_user_password` gained the matching warning; it had
none.

The prose fixes clear all 8 `CI / prose lint (vale, errors)` failures,
all of which were in docs this branch touches. No vale config change,
no exception, no carve-out: contractions, one recast sentence, one
de-hyphenation and one dropped "simply".

Tense: four docs described system behaviour in the future ("will
refuse", "will fetch and trust"). Reference docs get read from the
other side of the change, so they say what the system does.

docs/tools/hivectl.md

@@ -79,11 +79,11 @@ hivectl matrix invite @mara:server --room '#hive-chat:server'  # ...or to a spec
   access token path. Safe to run again — idempotent.
 - `promote-user`: promotes an already-registered user to homeserver
   admin by an `!admin` command in `#admins`. ⚠️ Needs an admin **sender**,
-  which `@hive:` is not — this operation is being rehomed at swarm level
-  and does not work from the hive today.
+  which `@hive:` isn't — this operation is being rehomed at swarm level
+  and doesn't work from the hive today.
 - `reset-password`: asks the admin room to set a new random
   password and prints it to stdout. ⚠️ Needs an admin **sender** too, so
-  it does not work from the hive today either. Useful if an agent or human lost
+  it doesn't work from the hive today either. Useful if an agent or human lost
   credentials.
 - `invite`: invites a matrix user (full `@user:server` or a bare
   localpart, qualified with the homeserver's `server_name`) to the hive
@@ -227,7 +227,7 @@ granting that group the one action `machinectl shell` needs); `choom`
 checks this itself and refuses up front with a message naming the
 requirement rather than letting systemd reject the exec later with an
 opaque polkit prompt. Same caveat as the socket grant: a shell opened
-before the operator added you to `hive-admin` won't see it until you log
+before the operator added you to `hive-admin` doesn't see it until you log
 back in — secondary group membership applies at login.
 
 It also needs the daemon socket, unlike the other exec-into-a-container