- **Creds-free by default.** The box starts with no Forgejo credentials and no
  git credentials. The runner binary is installed but **not registered**:
  registration needs a short-lived token the operator mints in Forgejo
  (Site Administration, org, or repo → Actions → Runners) and hands to
  `sudo rig forgejo-runner install --instance <url>`. The token is consumed at
  registration and never written to disk by rig. After that, the runner's own
  credential lives in `~/forgejo-runner/.runner`, mode 0600 — never copy it,
  print it, or commit it. Secrets that CI jobs need belong in Forgejo's repo or
  org secrets, injected per job, not on this box.