lint: tighten atomic-write-secret.nix's header comment; fix vale contractions in persistence.md

The header comment grew to 39 lines across two audit-driven rounds,
over the 30-line comment-block-lint max. Trimmed to 30: merged the
value-as-argument rationale with its /proc/cmdline justification into
one paragraph, cut the usage example to one call instead of two, and
condensed the args paragraph — no content dropped, just restatement.

persistence.md's first-boot-migration marker paragraph used "it is"
and "there is not" — vale's Microsoft.Contractions rule (this repo's
config) wants the contracted forms, and "is not" also collides with
"is nothing" as a literal substring, which is what actually tripped
the error. Reworded to "it's" / "there's nothing", no meaning change.

Lint-only: no script logic changed, gates re-run below are all lint
checks (no module-eval, no cargo).

Refs #4723

docs/agent-lifecycle/persistence.md

@@ -535,8 +535,8 @@ container lifetime:
 2. **Migrate any leftover `/root/.claude` content into
    `${homeDir}/.claude`** — legacy `claude` wrote to root's
    empty home; the bind mount didn't exist yet. Marker
-   (`/var/lib/hive-agent-user-migrated`) guards single-shot; it is
-   only written once there is nothing left to migrate, so a `cp`
+   (`/var/lib/hive-agent-user-migrated`) guards single-shot; it's
+   only written once there's nothing left to migrate, so a `cp`
    failure leaves it absent and the next boot retries.
    `cp -an` (no-clobber) so any pre-existing files at the new
    location win — never blow over data already there, and so a