docs: fix capitalization losses + one text corruption from the contractions pass

Review pass on top of the previous commit (85a94671) turned up three
real issues its own vale-only verification didn't catch:

- 'has not' -> 'hasn't' fired inside 'has nothing', corrupting
  docs/swarm/README.md into 'hasn'thing to say upward'. Restored
  'has nothing'.
- ~44 hits where the original text was genuinely sentence-initial
  ('It is', 'That is', 'They are', 'What is', 'Do not', ...) got
  contracted in lowercase, silently de-capitalizing the start of a
  sentence. Checked each one's real surrounding text and capitalized
  the ones that needed it.
- Confirmed (by reading the actual text, not just trusting vale) that
  the 3 remaining 'is not'/'has not'/'it is' hits after those fixes are
  vale's own false positives: it matches these as a bare substring with
  no trailing word boundary, so it also fires on 'is nothing', 'has
  nothing', and the already-correct 'it isn't'. Left those alone --
  there's no real issue in the text.

Re-verified with a fresh vale run: the remaining 17 hits are exactly
the union of the 14 legitimate ALL-CAPS/bold-emphasis skips from the
first commit and these 3 false positives. Full accounting in
/agents/iris/state/haiku-batches/contractions-report.md.

docs/networking/network.md

@@ -236,7 +236,7 @@ to all containers — agents and service containers alike.
 `HOST_ADDRESS` is the bridge gateway IP (the address part of
 `HIVE_NETWORK_SUBNET`, via `lifecycle::bridge_gateway_ip` — taken verbatim
 so a non-`.1` operator override still resolves to wherever the bridge
-actually lives). it's **load-bearing**: nixos-container's container-side
+actually lives). It's **load-bearing**: nixos-container's container-side
 network setup only installs a default route (`ip route add default via
 $HOST_ADDRESS`) when `HOST_ADDRESS` is non-empty. In bridge mode the
 host-side address/route setup is skipped, so writing it only affects the
@@ -257,7 +257,7 @@ wiring is runtime:
   gateway IP) into each container's `/etc`.
 - the `hyperhive-isolated-dns` oneshot (`nix/agent-modules/network.nix`), gated on that
   marker, rewrites `/etc/resolv.conf` to `nameserver <gateway-ip>` at boot.
-  it's ordered `before` the harness (`hive-ag3nt`), the matrix daemon, and
+  It's ordered `before` the harness (`hive-ag3nt`), the matrix daemon, and
   `tea-login` so the resolver is correct before the first DNS lookup.
 
 **Why isolation is safe**: hive-c0re's control-plane sockets are unix