- **Creds-free by default.** The box starts with no Forgejo credentials and no
  git credentials. The runner binary is installed but **not registered**:
  registration needs a token the operator mints in Forgejo (Site
  Administration, org, or repo → Actions → Runners) and hands to
  `sudo rig forgejo-runner install --instance <url>`. rig never writes that
  token to disk — but it does **not expire, and registering does not spend
  it**. A Forgejo registration token stays valid until somebody mints a
  replacement at that same scope, and it will register as many runners as it is
  shown to. Treat a leaked one as live until it has been replaced. (GitHub's
  equivalent expires in about an hour; do not carry that habit across.) After
  registration the runner's own credential lives in `~/forgejo-runner/.runner`,
  mode 0600 — never copy it, print it, or commit it. Secrets that CI jobs need
  belong in Forgejo's repo or org secrets, injected per job, not on this box.