Fix inconsistencies found by consistency audit of 395f76e

internal/agents/kb/client-exec.md

@@ -2,7 +2,7 @@ How a script or plain shell runs a command on a client Mac without an agent (byr
 
 # Running commands on a client Mac from a shell
 
-`client_bash` needs an agent. For a script or plain shell on the machine byre runs on, such as a wrapper that fetches a token from the human's Mac, use:
+`client_bash` needs an agent. For a script or plain shell on the Mac byre runs on, such as a wrapper that fetches a token from the human's Mac, use:
 
 ```
 byre client-exec [--client NAME] [--timeout SECS] -- CMD...

internal/agents/kb/signing.md

@@ -2,11 +2,11 @@ How byre signs merge commits on the merging user's Mac, and how to turn it on fo
 
 # Signing merge commits
 
-byre never signs with a key on the machine it runs on: its own end-of-turn and snapshot commits there are always unsigned. When a project checkout (or the server's global config) has `commit.gpgsign` true, the squash commit of a Merge or `merge_to_main` is signed on the merging user's most recently active connected Mac, so a key that never leaves that Mac (a Secure Enclave key behind Touch ID, say) works. The merge fails when that user has no app connected.
+byre never signs with a key on the Mac it runs on: its own end-of-turn and snapshot commits there are always unsigned. When a project checkout (or the server's global config) has `commit.gpgsign` true, the squash commit of a Merge or `merge_to_main` is signed on the merging user's most recently active connected Mac, so a key that never leaves that Mac (a Secure Enclave key behind Touch ID, say) works. The merge fails when that user has no app connected.
 
 ## Turning it on
 
-Run, on the machine byre runs on:
+Run, on the Mac byre runs on:
 
 ```
 byre signing <checkout>