docs(yami): note that runner tokenFile must be env-file format (TOKEN=...)

yami-dev-stack.nix

@@ -143,7 +143,10 @@ in
     };
 
     # Runner uses DynamicUser, so there's no static gitea-runner user/group.
-    # The token file is read by the root-run pre-start, so root owns it.
+    # tokenFile is loaded via systemd EnvironmentFile, so the file MUST be in
+    # env-file format, not a raw token:
+    #     TOKEN=<paste-registration-token-from-gitea-ui>
+    # Get the token from Site Administration → Actions → Runners → Create new Runner.
     systemd.tmpfiles.rules = [
       "d /var/lib/gitea-runner 0700 root root -"
     ];