docs: clear write-good.Passive hits in gateway/subagent/dashboard docs

Part of #4548 — rewriting the 353 hand-written-docs write-good.Passive
hits so #4546 can flip the rule to error. This batch: docs/networking/gateway.md
(27 hits), docs/tools/subagent.md (19), docs/web-ui/dashboard.md (18).

Minimal, meaning-preserving rewrites to active voice only — no
restructuring beyond what each flagged sentence needed. Genuine false
positives (predicate-adjective state descriptions like "is required",
"is broken", "is unchanged", adjectival past participles like "named
buckets", and one quoted literal UI string) are left in place; the
per-line reasoning is on the tracking issue.

Note: docs/tools/forge-cli.md (37 hits, would have been the single
biggest file) turned out to be generated from hive-forge's own clap
help text (see hive-forge/src/main.rs's `MarkdownDocs` verb) — same
category as the already-excluded hivectl-cli.md/swarmctl-cli.md, so
it's untouched here. Flagged on #4548.

docs/web-ui/dashboard.md

@@ -58,7 +58,7 @@ surfaces, not tab panes.
 
 **C0NTAINERS** — live containers rendered as a depth-first
 tree using `ContainerView.parent` (populated by
-`hive-c0re/src/agent_config/topology.rs` — not to be confused with
+`hive-c0re/src/agent_config/topology.rs` — don't confuse it with
 `hive-c0re/src/dashboard/topology.rs`, which only holds the
 set-parent endpoints).
 ASCII tree glyphs (`├─`, `└─`, `│  ` continuation columns) prefix
@@ -248,7 +248,7 @@ keeps or drops a whole group, never splitting mid-tree. Default selection is
 every state **except** `Done`/`Skipped` — a fresh queue view leads
 with what's still moving or needs attention, not the settled tail;
 builds.js omits the `states` param entirely (identical request to
-before this filter existed) when every state is checked. Server-side: the query
+before this filter existed) when the operator has checked every state. Server-side: the query
 narrows [`Queue::graph_snapshot`]'s already-bounded (`MAX_HISTORY_DAGS`)
 root set — the history cap and the state filter are independent
 concerns, so a narrow filter never reaches further back in time to
@@ -258,7 +258,7 @@ Below the queue, a **live build-log panel** (`#rebuild-live-log`,
 `renderRebuildLiveLog`) shows the currently running rebuild's output
 inline — collapsible, with a live/ok/fail badge and a `↓ raw`
 download. It's keyed to the first `Running` node (in wire order)
-whose `payload.data.build_log_id` is set — read from the `onUpdate`
+whose `payload.data.build_log_id` has a value — read from the `onUpdate`
 callback's node list, same source as the count pill, no separate
 fetch — and **polls** `GET /api/build-log/{id}` every 2s
 (`fetchAndRenderLiveLog` / `liveLogPollTimer`); not an `EventSource`
@@ -339,8 +339,8 @@ The status dot renders these states:
 - **grey** — no token (not provisioned).
 
 The container-down cross-reference (`/api/state`) takes precedence over
-the age check. `as_of_unix` is tooltipped ("live as of N ago") throughout
-so freshness is always legible. When `live` is absent (an older hive-c0re
+the age check. The dashboard tooltips `as_of_unix` ("live as of N ago")
+throughout so freshness is always legible. When `live` is absent (an older hive-c0re
 without the snapshot) the dot falls back to a token-present rendering.
 
 The provision form (account name, homeserver, login method) posts
@@ -444,8 +444,8 @@ The current capabilities are:
 
 Each row is one agent. Columns are the capability names returned by
 `GET /api/capabilities` as `caps: Vec<String>`. Checking or unchecking
-boxes only stages the change in-browser; nothing is written until the
-operator selects the page-level **save all** button (described below). Row
+boxes only stages the change in-browser; the browser writes nothing until
+the operator selects the page-level **save all** button (described below). Row
 values follow the `effective`/`assignments` rule described above.
 
 **T00L GR0UPS** — per-agent tool-group permissions. Tool groups are
@@ -1071,7 +1071,7 @@ renderApprovals`) with three stacked sections:
   kind-specific drill-in triggers:
   - `merge_config_pr`: `↳ review PR on forge ↗` deep-links the
     config PR into `agent-configs/<agent>/pulls/<pr_number>` (shown
-    only when `forge_present` and `pr_number` is set). The config diff
+    only when `forge_present` is true and `pr_number` has a value). The config diff
     lives on the forge PR itself — no inline diff side-panel.
   - `spawn`: a one-line "container will be created" note instead.
 - **decision actions** — `◆ APPR0VE` and `DENY`. Deny pops a
@@ -1251,7 +1251,7 @@ below — some endpoints aren't in it yet.
   an agent's tool-groups and capabilities triggers a single rebuild,
   not two. **Atomic**: the endpoint validates every change first (agent names via
   `guard_agent_name`, group + capability names) and on any validation
-  error nothing is written or enqueued (non-2xx `{ error }`); it skips
+  error writes or enqueues nothing (non-2xx `{ error }`); it skips
   rows with both fields omitted rather than erroring on them.
   Returns `200 "ok"` on
   success.
@@ -1266,8 +1266,8 @@ below — some endpoints aren't in it yet.
   targets_add?, targets_remove? }`.
   Missing key = "leave alone"; explicit `null` on
   `description` / `interval_seconds` clears the field (so a
-  recurring schedule flips to one-shot when `interval_seconds`
-  is sent as `null`). `targets_add` is replace-on-conflict:
+  recurring schedule flips to one-shot when the caller sends
+  `interval_seconds` as `null`). `targets_add` is replace-on-conflict:
   re-adding a previously cancelled target drops the tombstone
   and the target starts fresh (operator intent on re-add =
   "this target is active again"). `targets_remove` delegates