Rebuild the site as a typographic verification surface

.github/workflows/ci.yml

@@ -6,11 +6,17 @@ on:
   pull_request:
     branches: [master]
 
+# Every job here only reads the repo and runs the build/test tooling.
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
@@ -23,6 +29,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
@@ -35,6 +43,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
@@ -47,6 +57,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:

.github/workflows/deploy.yml

@@ -3,9 +3,6 @@ name: Deploy
 on:
   push:
     branches: [master]
-  # Refresh the deployed GitHub stats on the 1st of each month, even without a push.
-  schedule:
-    - cron: '0 7 1 * *'
   workflow_dispatch:
 
 concurrency:
@@ -27,13 +24,6 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      # Fetch the latest public GitHub stats at build time. The committed
-      # data/github-stats.json is only a fallback, so a transient API failure
-      # degrades to slightly stale stats instead of breaking the deploy.
-      - name: Fetch GitHub stats
-        env:
-          GH_STATS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm run fetch-github || echo "Stats fetch failed; building with committed data/github-stats.json"
       - run: pnpm run build
       - uses: cloudflare/wrangler-action@v3
         with:

.gitignore

@@ -9,6 +9,10 @@ package-lock.json
 /.svelte-kit
 /build
 
+# Local tooling scratch (playwright-cli sessions, static-analysis reports)
+.playwright-cli
+.static-analysis
+
 # OS
 .DS_Store
 Thumbs.db

.prettierignore

@@ -3,5 +3,8 @@ package-lock.json
 pnpm-lock.yaml
 yarn.lock
 
-# Generated data
-data/github-stats.json
+# Generated by the static-analysis skill (git-ignored globally)
+.static-analysis/
+
+# Machine-local Claude Code settings (git-ignored globally, never reaches CI)
+.claude/settings.local.json