Function token_role 

pub fn token_role() -> CallerRole

Return the CallerRole granted to token-authenticated vsock connections.

Reads SYSKNIFE_TOKEN_ROLE env var (surrounding whitespace is trimmed). When unset or empty it defaults to Dev — the documented default for token-authenticated vsock guests. An unrecognized value fails closed to Observer (read-only) with a warning, rather than silently granting the mutating Dev tier on an operator typo.