docs: fix write-good.So/ThereIs/Weasel lint findings

Fixes the "obvious ones first" slice of #4042 (mara: do the obvious
ones first) -- 81 hits across write-good.So, write-good.ThereIs, and
write-good.Weasel, all in docs/. Each is a genuine sentence rewrite
(lead with the real subject instead of "There is/are", drop a
sentence-initial "So ", replace a vague intensifier), not a blind
regex substitution -- read every hit in its real file context before
touching it.

3 of the 81 hits were in CI-generated CLI docs (docs/tools/{hivectl,
swarmctl,forge}-cli.md) -- fixed at the clap #[arg(...)]/doc-comment
source in hivectl/src/cli.rs, swarmctl/src/main.rs, and
hive-forge/src/verbs/repo_add_collaborator.rs, then regenerated via
each crate's `markdown-docs` subcommand so CI's freshness check stays
green.

Verified: fresh vale re-run shows 0 remaining So/ThereIs/Weasel hits
and no new hits introduced (983->982, exactly the one incidental fix
this pass also picked up at docs/scheduler/observability.md:48).
cargo fmt --check and clippy clean on the three touched crates.

Remaining write-good backlog (Passive: 726, TooWordy: 207) is
judgment-heavy and left for a follow-up slice of #4042, not bulk-
rewritten here.

docs/trust-boundary/boundary.md

@@ -87,7 +87,7 @@ systemd unit. The unit binds `/run/hive/priv.sock` with
 to the helper as fd 3 (`LISTEN_FDS`). The helper requires this and
 bails if it isn't socket-activated.
 
-⚠️ There is intentionally no self-bind fallback: if `hive-priv` bound
+⚠️ Intentionally, no self-bind fallback exists: if `hive-priv` bound
 the socket itself, it would create the file owned by root's primary
 group rather than `hive-core`, and a `hive-core` client couldn't
 connect the way the socket unit's `SocketGroup` grant intends.

docs/trust-boundary/security.md

@@ -34,7 +34,7 @@ Each agent gets its own scoped credentials, never shared:
   collaborator grants; can't act as another agent or as `core`).
 - **matrix token** → that agent's matrix account only.
 
-So a compromised/confused agent's reach on the forge or matrix is bounded by
+A compromised/confused agent's reach on the forge or matrix is bounded by
 _its own_ account's scope, not the swarm's. This is the main thing standing
 between "one agent does something dumb" and "the whole hive is affected."