hive-forge, hivectl, swarmctl: fix clap help passive voice, regen docs

Rewrites every write-good.Passive hit in the hive-forge clap help text
into terse, imperative, active voice (meaning unchanged) and drops
clap-markdown's own fixed footer ('This document was generated
automatically by...') via MarkdownOptions::show_footer(false), since
that string isn't ours to reword and vale flagged it too.

docs/tools/{hivectl,swarmctl,forge}-cli.md are generated from each
crate's clap tree (see hive-forge/src/main.rs's MarkdownDocs verb) —
regenerated here from the fixed source, not hand-edited.

Refs #4549

hivectl/src/cli.rs

@@ -49,8 +49,8 @@ pub enum Cmd {
     /// GitHub account provisioning.
     ///
     /// Store an operator-supplied personal access token (PAT) for an agent
-    /// so its `gh` and git can authenticate. No account is created — the
-    /// PAT is for an existing GitHub account.
+    /// so its `gh` and git can authenticate. Creates no account — the PAT
+    /// is for an existing GitHub account.
     Github {
         #[command(subcommand)]
         cmd: GithubCmd,
@@ -551,7 +551,7 @@ pub enum AgentCmd {
         /// takes no value — it resumes the cwd's latest session, which
         /// is the harness's, so choom never uses it; this flag matches
         /// the claude flag it maps to). Omit for a fresh blank session.
-        /// A value is required when the flag is given.
+        /// Requires a value.
         #[arg(long = "resume", value_name = "SESSION")]
         resume_session: Option<String>,
     },
@@ -662,7 +662,7 @@ pub enum SnapshotCmd {
     /// Stream a snapshot to the swarm's snapshot store over the
     /// WireGuard mesh — the network half of the migration transport.
     ///
-    /// Nothing is staged locally: `btrfs send` writes straight into the
+    /// Stages nothing locally: `btrfs send` writes straight into the
     /// connection, so a multi-gigabyte agent needs no scratch space on
     /// this host. The mesh is the authentication (cryptokey routing
     /// binds the sender's address to its key), so there is no credential