docs: fix capitalization losses + one text corruption from the contractions pass

Review pass on top of the previous commit (85a94671) turned up three
real issues its own vale-only verification didn't catch:

- 'has not' -> 'hasn't' fired inside 'has nothing', corrupting
  docs/swarm/README.md into 'hasn'thing to say upward'. Restored
  'has nothing'.
- ~44 hits where the original text was genuinely sentence-initial
  ('It is', 'That is', 'They are', 'What is', 'Do not', ...) got
  contracted in lowercase, silently de-capitalizing the start of a
  sentence. Checked each one's real surrounding text and capitalized
  the ones that needed it.
- Confirmed (by reading the actual text, not just trusting vale) that
  the 3 remaining 'is not'/'has not'/'it is' hits after those fixes are
  vale's own false positives: it matches these as a bare substring with
  no trailing word boundary, so it also fires on 'is nothing', 'has
  nothing', and the already-correct 'it isn't'. Left those alone --
  there's no real issue in the text.

Re-verified with a fresh vale run: the remaining 17 hits are exactly
the union of the 14 legitimate ALL-CAPS/bold-emphasis skips from the
first commit and these 3 false positives. Full accounting in
/agents/iris/state/haiku-batches/contractions-report.md.

docs/scheduler/observability.md

@@ -54,7 +54,7 @@ credential.** Neither tier can tell a container's genuine Claude Code stats
 from anything else shaped like OTLP arriving on that port — including data
 smuggled out in resource attributes on an otherwise-legitimate export.
 
-that's a **different risk from the one the collector fixes**, and strictly
+That's a **different risk from the one the collector fixes**, and strictly
 smaller than what preceded it: before, every agent held the upstream credential
 itself, so it could do all of the above _and_ use the token anywhere else. The
 collector removes the token and keeps the pipe. Agents are inside the trust
@@ -122,7 +122,7 @@ read. `0600` protects it from other containers, not from the agent itself. As
 long as the direct path stays _selectable_, that hole stays selectable; an
 option that can reintroduce it's a hole with extra steps.
 
-**Why the tiers stay separate on one box.** they're not collapsed when
+**Why the tiers stay separate on one box.** They're not collapsed when
 co-located: an all-local hive is a statement about _where_ processes run, not
 about the shape of the deployment. A boundary that disappears locally is one
 the local deployment stops testing.