docs: fix write-good.So/ThereIs/Weasel lint findings

Fixes the "obvious ones first" slice of #4042 (mara: do the obvious
ones first) -- 81 hits across write-good.So, write-good.ThereIs, and
write-good.Weasel, all in docs/. Each is a genuine sentence rewrite
(lead with the real subject instead of "There is/are", drop a
sentence-initial "So ", replace a vague intensifier), not a blind
regex substitution -- read every hit in its real file context before
touching it.

3 of the 81 hits were in CI-generated CLI docs (docs/tools/{hivectl,
swarmctl,forge}-cli.md) -- fixed at the clap #[arg(...)]/doc-comment
source in hivectl/src/cli.rs, swarmctl/src/main.rs, and
hive-forge/src/verbs/repo_add_collaborator.rs, then regenerated via
each crate's `markdown-docs` subcommand so CI's freshness check stays
green.

Verified: fresh vale re-run shows 0 remaining So/ThereIs/Weasel hits
and no new hits introduced (983->982, exactly the one incidental fix
this pass also picked up at docs/scheduler/observability.md:48).
cargo fmt --check and clippy clean on the three touched crates.

Remaining write-good backlog (Passive: 726, TooWordy: 207) is
judgment-heavy and left for a follow-up slice of #4042, not bulk-
rewritten here.

docs/scheduler/observability.md

@@ -5,7 +5,7 @@ token usage, cost, tool call counts — to any OTLP-compatible collector via
 Claude Code's built-in OpenTelemetry integration.
 
 This is a **hive-wide** setting: one switch in the host NixOS config enables it
-for every agent container simultaneously. There is no per-agent opt-in or opt-out.
+for every agent container simultaneously. No per-agent opt-in or opt-out exists.
 
 ## Enabling export
 
@@ -22,7 +22,7 @@ leaves the swarm — optional, because the swarm's own metrics store
 telemetry goes to both. See
 [`swarm/services.md`](../swarm/services.md#metrics-victoriametrics--grafana).
 
-**There is exactly one way telemetry leaves a hive: through the collector that
+**Telemetry leaves a hive exactly one way: through the collector that
 `enable` starts on the host.** Agents never talk to `endpoint` themselves —
 they export unauthenticated to a bridge address only their own containers can
 reach. That collector forwards to the swarm's
@@ -45,7 +45,7 @@ no longer survives independently of anything host-side.
 
 **It has no application-level auth.** The receiver takes any OTLP that reaches
 it; what bounds who can reach it's the firewall — `exposeHostPorts` opens the
-port on the bridge interface only. So "unauthenticated to a bridge address"
+port on the bridge interface only — "unauthenticated to a bridge address"
 means _reachable from an agent container_, not _presents a credential_.
 
 The consequence, stated because it's a choice rather than an oversight: **any
@@ -76,7 +76,7 @@ is getting a credential:
   `hive=` from the connection it authenticated, so _that_ label becomes
   unforgeable.
 
-So a verified `hive` is reachable and a verified `agent` isn't — and that falls
+A verified `hive` is reachable and a verified `agent` isn't — and that falls
 out of the topology rather than being a gap someone forgot to close. The swarm
 runs one collector, and the mechanism gives it no finer grain: a bearer-token
 check never reveals _which_ token matched, and a receiver reads request metadata
@@ -150,7 +150,7 @@ somehow — copy it across and name it:
 services.hyperhive.otel.clientSecretFile = "/run/secrets/hive-telemetry.secret";
 ```
 
-**There is no unauthenticated mode.** A hive always presents an identity, so a
+**No unauthenticated mode exists.** A hive always presents an identity, so a
 missing credential is a build error rather than a quieter fallback — the
 collector has no anonymous route to accept samples on, and every path it serves
 belongs to exactly one hive.