docs: --labels replaces the default label set, not appends

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -76,8 +76,8 @@ whose whole point is a narrow blast radius. Add Docker only once a job
 genuinely needs it, and rethink the isolation model then.
 
 - `--name <name>` — runner name (default: this host's hostname)
-- `--labels <csv>` — extra runner labels (default: `ci-runner`; GitHub adds
-  `self-hosted` itself)
+- `--labels <csv>` — runner labels, replacing the `ci-runner` default — keep
+  any label your workflows' `runs-on` needs (GitHub adds `self-hosted` itself)
 - `--user <name>` — the unprivileged service user (default: `github-runner`)
 
 **The registration token:** provide it via the `RUNNER_TOKEN` env var or type

commands/runner-install.sh

@@ -16,7 +16,7 @@ usage: rig runner install --repo <owner/repo> --version <pin> [options]
   --version <pin>       actions/runner release to install, e.g. 2.335.1
                         (required; no default — you state what you install)
   --name <name>         runner name (default: this host's hostname)
-  --labels <csv>        extra runner labels (default: ci-runner)
+  --labels <csv>        runner labels; replaces the default (default: ci-runner)
   --user <name>         unprivileged service user (default: github-runner;
                         created if absent; never root)