docs: fix capitalization losses + one text corruption from the contractions pass

Review pass on top of the previous commit (85a94671) turned up three
real issues its own vale-only verification didn't catch:

- 'has not' -> 'hasn't' fired inside 'has nothing', corrupting
  docs/swarm/README.md into 'hasn'thing to say upward'. Restored
  'has nothing'.
- ~44 hits where the original text was genuinely sentence-initial
  ('It is', 'That is', 'They are', 'What is', 'Do not', ...) got
  contracted in lowercase, silently de-capitalizing the start of a
  sentence. Checked each one's real surrounding text and capitalized
  the ones that needed it.
- Confirmed (by reading the actual text, not just trusting vale) that
  the 3 remaining 'is not'/'has not'/'it is' hits after those fixes are
  vale's own false positives: it matches these as a bare substring with
  no trailing word boundary, so it also fires on 'is nothing', 'has
  nothing', and the already-correct 'it isn't'. Left those alone --
  there's no real issue in the text.

Re-verified with a fresh vale run: the remaining 17 hits are exactly
the union of the 14 legitimate ALL-CAPS/bold-emphasis skips from the
first commit and these 3 false positives. Full accounting in
/agents/iris/state/haiku-batches/contractions-report.md.

docs/networking/gateway.md

@@ -206,7 +206,7 @@ On by default, and listens on `httpsPort` (default 443) on every vhost beside th
 
 The issuer is a **host-held hive CA**, not a bare self-signed leaf. A host service (`hive-tls-ca.service`, from the `hive-tls` module) generates a long-lived CA (`services.hyperhive.deploy.hive-controller.tls.caValidityDays`, default ~20y) under `services.hyperhive.deploy.hive-controller.tls.stateDir` (default `/var/lib/hive-tls`), then signs a gateway **leaf** (`leafValidityDays`, default 30d) with it. `hive-gateway-self-signed-cert` then imports the leaf into nginx's state dir (`/var/lib/hive-gateway/tls/{cert,key}.pem`).
 
-⚠️ **don't collapse that import unit into pointing nginx at the CA dir.**
+⚠️ **Don't collapse that import unit into pointing nginx at the CA dir.**
 It does two jobs, and skipping it has taken the gateway down in production
 before. It re-modes the leaf (`hive-tls-ca` writes the key `0600
 root:root`; nginx's pre-start `nginx -t` runs as the *nginx user*, so a
@@ -455,7 +455,7 @@ legacy single-proxy block and all traffic is forwarded to the agent
 daemon as before.
 
 **`extraFiles`**: per-agent `hyperhive.frontend.extraFiles` are in
-`mergedDist`, not in the base `cfg.frontend` dist. they're not under
+`mergedDist`, not in the base `cfg.frontend` dist. They're not under
 the nix-store `alias` path, so requests for them fall through
 `try_files` to `@<name>_dynamic` and are served by the agent daemon
 as before.
@@ -542,7 +542,7 @@ The daemon hashes passwords with BCrypt (cost 12) and writes
 `$2y$`-prefixed hashes that nginx accepts natively. No external
 `htpasswd` binary is required.
 
-**what's not gated:** per-agent UI routes emitted into `agents.conf`
+**What's not gated:** per-agent UI routes emitted into `agents.conf`
 (served under `/agent/<name>/`) inherit no auth from `/` — nginx
 applies `auth_basic` per-location. Full per-agent coverage is a
 follow-up.

docs/networking/network.md

@@ -236,7 +236,7 @@ to all containers — agents and service containers alike.
 `HOST_ADDRESS` is the bridge gateway IP (the address part of
 `HIVE_NETWORK_SUBNET`, via `lifecycle::bridge_gateway_ip` — taken verbatim
 so a non-`.1` operator override still resolves to wherever the bridge
-actually lives). it's **load-bearing**: nixos-container's container-side
+actually lives). It's **load-bearing**: nixos-container's container-side
 network setup only installs a default route (`ip route add default via
 $HOST_ADDRESS`) when `HOST_ADDRESS` is non-empty. In bridge mode the
 host-side address/route setup is skipped, so writing it only affects the
@@ -257,7 +257,7 @@ wiring is runtime:
   gateway IP) into each container's `/etc`.
 - the `hyperhive-isolated-dns` oneshot (`nix/agent-modules/network.nix`), gated on that
   marker, rewrites `/etc/resolv.conf` to `nameserver <gateway-ip>` at boot.
-  it's ordered `before` the harness (`hive-ag3nt`), the matrix daemon, and
+  It's ordered `before` the harness (`hive-ag3nt`), the matrix daemon, and
   `tea-login` so the resolver is correct before the first DNS lookup.
 
 **Why isolation is safe**: hive-c0re's control-plane sockets are unix

docs/networking/snapshot-store.md

@@ -7,11 +7,11 @@ complete a migration.
 Two things it's not, both worth stating because both are common
 assumptions:
 
-- **it's not the swarm controller**, and doesn't depend on one. it's
+- **It's not the swarm controller**, and doesn't depend on one. It's
   a NixOS host role: a btrfs subvolume tree, a socket-activated
   receiver, and the `wg-hive` interface the swarm module already brings
-  up. that's why it can be deployed before any controller exists.
-- **it's not a backup product.** It happens to hold the data a backup
+  up. That's why it can be deployed before any controller exists.
+- **It's not a backup product.** It happens to hold the data a backup
   would hold, and it should be operated accordingly (see
   [Operating it](#operating-it)) --- but nothing in it does scheduling,
   verification, or restore orchestration.
@@ -56,7 +56,7 @@ services.hyperhive.swarm.snapshotStore = {
 Two deliberate asymmetries in that pair, both liable to be misread as
 inconsistency:
 
-- **`address` has no default.** it's a deployment fact a pushing hive
+- **`address` has no default.** It's a deployment fact a pushing hive
   can't derive, and a wrong guess means streaming an agent's state at
   whatever happens to answer. Unset, a push fails naming this option.
 - **`port` does default** (`51821`), because it's a convention both
@@ -64,7 +64,7 @@ inconsistency:
   coordination, not a guess.
 
 Note the option lives under `swarm.*` while the receiving host's lives
-under `services.hyperhive.snapshotStore`. that's the distinction the
+under `services.hyperhive.snapshotStore`. That's the distinction the
 two namespaces carry throughout: `swarm.*` describes _the swarm_ as seen
 from this host, and a bare `services.hyperhive.<service>` describes _a
 role this host performs_. A store host sets both --- one to run the
@@ -78,7 +78,7 @@ and no credential argument, because the mesh is the authentication.
 
 ## The mesh is the authentication
 
-There are no certificates here, and no key material of its own. that's
+There are no certificates here, and no key material of its own. That's
 deliberate rather than an omission.
 
 WireGuard's cryptokey routing already binds a peer's source address to
@@ -116,7 +116,7 @@ The rule that matters:
 
 Validation is an allowlist --- `[A-Za-z0-9_-]+` and nothing else. No
 slash and no dot means neither directory traversal nor an absolute path
-can survive it. it's deliberately an allowlist and not a list of
+can survive it. It's deliberately an allowlist and not a list of
 forbidden characters: a blocklist only ever excludes the attacks
 somebody already thought of.
 
@@ -165,7 +165,7 @@ nobody runs it day to day, so it rots and is discovered broken in
 production.
 
 ⚠️ **The assumption to keep true over time:** the store host runs
-nothing else. that's true on day one and quietly false the day someone
+nothing else. That's true on day one and quietly false the day someone
 notices the box has spare disk. Nothing in the config objects when it
 stops being true.