docs: fix capitalization losses + one text corruption from the contractions pass

Review pass on top of the previous commit (85a94671) turned up three
real issues its own vale-only verification didn't catch:

- 'has not' -> 'hasn't' fired inside 'has nothing', corrupting
  docs/swarm/README.md into 'hasn'thing to say upward'. Restored
  'has nothing'.
- ~44 hits where the original text was genuinely sentence-initial
  ('It is', 'That is', 'They are', 'What is', 'Do not', ...) got
  contracted in lowercase, silently de-capitalizing the start of a
  sentence. Checked each one's real surrounding text and capitalized
  the ones that needed it.
- Confirmed (by reading the actual text, not just trusting vale) that
  the 3 remaining 'is not'/'has not'/'it is' hits after those fixes are
  vale's own false positives: it matches these as a bare substring with
  no trailing word boundary, so it also fires on 'is nothing', 'has
  nothing', and the already-correct 'it isn't'. Left those alone --
  there's no real issue in the text.

Re-verified with a fresh vale run: the remaining 17 hits are exactly
the union of the 14 legitimate ALL-CAPS/bold-emphasis skips from the
first commit and these 3 false positives. Full accounting in
/agents/iris/state/haiku-batches/contractions-report.md.

docs/swarm/ca.md

@@ -5,7 +5,7 @@ hive's own CA, and that hive CA signs the gateway leaf. A peer that
 trusts the root once validates every hive in the swarm, present and
 future, instead of being pinned to each one by hand.
 
-that's the whole point of the hierarchy — it turns per-peer trust from
+That's the whole point of the hierarchy — it turns per-peer trust from
 O(n²) hand-pinning into one anchor per swarm.
 
 ## Two provisioning modes, one structure
@@ -49,7 +49,7 @@ swarm-services leaf can, and this host signs that one only under
 and every client sees a name mismatch.
 
 So `hive-tls` emits an eval-time **warning** naming the uncovered names.
-it's deliberately not an assertion: this module can see what _it_ is
+It's deliberately not an assertion: this module can see what _it_ is
 able to issue, but not an operator-installed sub-CA in
 `swarm.ca.stateDir`, an external ACME setup, or a certificate delivered
 by any other means. If you have arranged one, the warning is expected
@@ -89,7 +89,7 @@ host:
 scp /var/lib/swarm-ca/root.pem <peer-host>:/var/lib/swarm-ca/root.pem
 ```
 
-that's the point of the hierarchy: the root is installed **once per
+That's the point of the hierarchy: the root is installed **once per
 swarm host**, not once per peer, so a hive joining later needs no edit on
 the hives already running. A hive whose cert already chains to a public
 CA has nothing to install — `peer-config` says so instead.
@@ -98,7 +98,7 @@ Handing a peer this hive's own `ca.pem` would not work even as a
 one-off: once a hive CA is an intermediate under the swarm root, it's
 no longer something a verifier can build a chain _to_ — OpenSSL won't
 terminate a chain at a trusted non-self-signed certificate without
-`-partial_chain`. that's why the tool distributes the root, not a
+`-partial_chain`. That's why the tool distributes the root, not a
 per-hive file.
 
 ## Adopting the hierarchy on an existing hive
@@ -117,7 +117,7 @@ Adoption happens by itself, once. `hive-tls-ca.service` notices that
 `ca-previous.pem`, and re-issues under the root; the next leaf is signed
 by the new CA.
 
-it's safe to automate here precisely because this is the
+It's safe to automate here precisely because this is the
 all-on-one-host shape: every consumer is on this box, so "when will they
 have refreshed" is knowable rather than guessed.
 
@@ -147,7 +147,7 @@ build log isn't something anyone reads twice.
 
 To keep the current CA on purpose — a hive that deliberately stays
 outside the hierarchy, or one mid-migration — `touch` the marker file
-named in the message. that's a decision, and it's recorded as one.
+named in the message. That's a decision, and it's recorded as one.
 
 A hive with **no** root configured at all isn't affected by any of
 this: it self-signs exactly as it always has.