docs: STE pass over the user guide — minimize em dashes, active voice, short words

[fentas]

STE (Simplified Technical English) rewrite pass over every user-facing doc: all of docs/guide/*.md plus docs/reference/cli.md. kubehz house profile, FLAVORED mode, with the updated em-dash policy as the main focus.

This is a form pass, not a content edit. Every fact, flag, number, version, and caveat is preserved. Headings, link targets, code blocks, frontmatter, and VitePress container syntax are untouched.

What changed

• Em dashes minimized: 609 → 68 across the corpus (541 removed). Replacements in order of preference: sentence splits, commas, colons for a consequence/definition, parentheses for asides. The 68 that remain are all in protected positions (see below).
• Active voice where the actor is known ("lok8s deep-merges the inline config", "the apiserver rejects", "the provider logs").
• Short common words: provide → give/serve/pass, plus the rest of the banned list where it appeared in prose.
• Long dash-spliced sentences split; condition-before-command ordering kept.
• Table — placeholders for "empty" became (none) (index.md profiles table, kubehz.md --node-ip default, toolchain.md profiles table) — no information lost.

Lint scores (ste-lint.py, flavored mode)

Both per100w and em_dash dropped (or stayed equal) on every file:

File	per100w before → after	em_dash before → after
guide/addons.md	2.77 → 1.85	85 → 9
guide/audit.md	3.21 → 2.13	23 → 4
guide/backups.md	2.41 → 2.11	8 → 2
guide/bare-metal.md	2.60 → 1.92	49 → 5
guide/capi.md	1.79 → 0.99	8 → 0
guide/cloud-init.md	1.52 → 1.14	19 → 3
guide/concepts.md	2.75 → 1.36	37 → 5
guide/deployment.md	3.07 → 2.64	24 → 1
guide/index.md	2.63 → 1.47	21 → 1
guide/inventory.md	3.11 → 2.90	9 → 1
guide/kubehz.md	2.42 → 1.95	77 → 9
guide/local-dev.md	2.09 → 1.89	27 → 4
guide/lo-chat.md	2.37 → 1.89	16 → 2
guide/networking.md	2.55 → 1.96	18 → 3
guide/operator.md	3.21 → 2.28	7 → 1
guide/recover.md	3.17 → 2.99	20 → 1
guide/secrets.md	2.38 → 2.08	37 → 3
guide/security.md	3.62 → 2.20	8 → 1
guide/services.md	2.39 → 2.19	55 → 11
guide/shared-registries.md	3.36 → 3.23	23 → 2
guide/testing.md	2.23 → 1.96	1 → 0
guide/toolchain.md	1.40 → 1.40	11 → 0
reference/cli.md	2.80 → 2.23	26 → 0

Deliberately left in place

The 68 remaining em/en dashes are all in positions the hard guards protect:

• Heading text (anchors derive from it): ## Hooks — re-run a Job or restart on edit, ### envoy-gateway — upgrading in place, ### sso-gate — OIDC login in front of any service, ## Addons vs targets vs inline — where does it go?, ### One cluster per plane — NOT per subdomain or service, ### Plane A/B — …, ## What is stored — and what never is, ## Preserving the client IP — PROXY protocol, ### Where it's configured — the driver, not a cluster resource, ### Common case — resolve a zone to the gateway LB, # Local AI — lo chat, plus the 1–3 en-dash range in a services.md heading.
• VitePress container titles (part of the ::: declaration line): ::: danger BREAKING CHANGE — migrate before your next lo up, ::: tip Generated post-install — preview it, ::: warning BREAKING CHANGE — existing KubeOne clusters.
• Code blocks and quoted CLI/log output: YAML/JSON comments, the bootstrap skip log line, the lo audit FAIL output, the lo recover DONE in XmYs — phases: … summary, the components mutual-exclusion error string, the doctor advice string in bare-metal.md (quoted tool output; rewording would misquote what the tool prints).
• Link text / link targets that match headings elsewhere: [Specs reference — Provider], [CLI reference — Remote clusters], [Specs — Provider and remote mode], [Specs reference — Registries Configuration], and the #plane-b-—-workloads-targets anchor in services.md.

No heading violates STE badly enough to flag beyond the dashes listed above.

Verification

• python3 ste-lint.py before/after on every file (table above); a mid-pass regression on local-dev.md (self-introduced semicolons) was caught and fixed before commit.
• ./node_modules/.bin/vitepress build docs passes clean (client + server bundles, page render, sitemap).

Do not merge without review — per house policy this PR should go through the review loop first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MoNRvwDrEPJeGGgQtLHxqv