Experience shows that a single registration token for both shared and
project-locked runners (eg. shadow) works fine. Will add bits about
custom roles for runners in subsequent commit.