Drop last --token hint; note sudo drops DRB_ENROLLMENT_TOKEN (node-26#18)

- key_pickup.py still told operators to re-run install.sh with --token.
- `curl | sudo bash` resets the env, so the documented exported-token
  path needs `sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -149,7 +149,8 @@ curl -fsSL https://git.vpn.cusano.net/logan/node-26/raw/tag/v1/install.sh \
 It prompts (hidden input) for an enrollment token, minted at **Settings → Nodes**
 in the web app. The token never goes on the command line — argv lands in shell
 history and `ps` (node-26#18). Unattended installs use `--token-file PATH` (mode
-0600) or an exported `DRB_ENROLLMENT_TOKEN`; the old `--token` flag still works
+0600) or an exported `DRB_ENROLLMENT_TOKEN` (pass it through with
+`sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; plain `sudo` drops it); the old `--token` flag still works
 but warns. Run `install.sh --help` for every flag; each also has a `DRB_*` env
 var. `--build` compiles op25 on the Pi (~1h) instead of pulling.