agents keep their github token in /run, fetched on every start, not in the state dir

docs/4-implementation/agent-tools/github.md

@@ -17,9 +17,10 @@ When enabled, the container gets:
   Host-scoped, so it never touches the forge (`localhost:3000`) or any
   other remote.
 
-Both scripts read the token from `<state>/github-token` **at invocation
-time**, so a PAT written (or rotated) mid-session takes effect immediately
-— no container rebuild or restart. Until the file exists, `gh` / `git push`
+Both scripts read the token from `/run/hive-agent-github-token/token`
+(`services.hyperhive.agent.github.tokenFile`) **at invocation
+time**, so a PAT fetched (or rotated) mid-session takes effect immediately
+— no container rebuild or restart. They never read the state dir. Until the file exists, `gh` / `git push`
 fail unauthenticated. The build bakes the token path into the scripts
 (rather than reading it from an env var), because claude's Bash tool runs in a
 minimal environment that wouldn't carry one.
@@ -42,12 +43,13 @@ rather than merely switched off. it's also why this isn't a cargo
 feature — a feature would unify across the workspace and cost every
 crate its build cache.
 
-At runtime the poller needs the PAT above. No PAT, no polling: the unit
+At runtime the poller needs the PAT above, at the path in
+`HIVE_GITHUB_TOKEN_FILE` (the same `/run` file). No PAT, no polling: the unit
 logs why and exits 0, which is why it's `Restart = on-failure` and
 never `always` — a clean exit on a PAT-less agent must not become a
 restart loop. The poller waits about ten minutes for the PAT to appear
 before it gives up. A path unit (`hive-github-notify.path`) starts the poller
-again when `<state>/github-token` changes, so a PAT that lands later still
+again when the token file changes, so a PAT that lands later still
 enables polling. Once polling, it re-reads the file on every
 tick, so it picks up a rotated PAT on the next tick without a restart.