fix(#2415): treefmt Rust + Errors doc on register_ci_runner (argus review)

Ran nix fmt on the whole change (not just the .nix): rustfmt wraps the long
ci_enabled() is_ok_and line that tripped the treefmt CI gate. Adds the # Errors
doc section on the pub priv_client::register_ci_runner per the HOW-TO rule.

hive-c0re/src/forge/ci_runner.rs

@@ -25,7 +25,8 @@ const RUNNER_FILE: &str = "/var/lib/nixos-containers/hive-ci/var/lib/gitea-runne
 /// `services.hyperhive.forge.ci.enable` is on; absent means CI is off and
 /// there is no hive-ci container to register a runner for.
 fn ci_enabled() -> bool {
-    std::env::var("HYPERHIVE_FORGE_CI_ENABLED").is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+    std::env::var("HYPERHIVE_FORGE_CI_ENABLED")
+        .is_ok_and(|v| v == "1" || v.eq_ignore_ascii_case("true"))
 }
 
 /// Ensure the hive-ci runner is registered against the forge. Best-effort:

hive-c0re/src/priv_client.rs

@@ -327,6 +327,11 @@ pub async fn restart_matrix_daemon(agent_name: &str) -> Result<()> {
 /// `/run/hive-ci/runner-token` env-file and restarts the in-container runner.
 /// The forge admin token stays in hive-c0re; only the registration token
 /// crosses to the (host-path) env-file the container bind-mounts read-only.
+///
+/// # Errors
+/// Propagates the hive-priv call failure: the socket / IPC error, or the
+/// root-side error when the token is rejected (empty or control characters),
+/// the env-file write fails, or the runner restart exits non-zero.
 pub async fn register_ci_runner(token: &str) -> Result<()> {
     ok(call(&PrivRequest::RegisterCiRunner {
         token: token.to_owned(),