[DaniAkash]

Summary

Fixes the two issues from the automated review on #1.

Changes

Scope Pages write permissions to the deploy job (.github/workflows/pages.yml)

• The workflow previously granted pages: write and id-token: write at the top level, so the pull request build job, which installs dependencies and runs the Astro build on PR code, received write-capable credentials.
• The workflow now defaults to contents: read. Only deploy gets pages: write and id-token: write, and that job never runs on pull requests. These are the two permissions actions/deploy-pages documents as required.

Make kit removal keep the user's own files (quick-start.mdx, faq.md)

• Setup skips files that already exist, but "Remove the kit" ran an unconditional rm. That could delete a user's own AGENTS.md, rustfmt.toml or other config.
• The removal script now:
  • deletes a file only if it is byte-identical to the kit's published version, and reports any it keeps
  • removes CLAUDE.md only when it is a symlink to an AGENTS.md the script just removed
  • suggests reverting the adoption commit first
  • lists the manual steps: the Cargo.toml lint tables, and a merged AGENTS.md section
• The FAQ answer points to the same safe path.

Verification

• Ran the removal script, extracted from the page, against the live /files/:
  • Kit-only project: all five files and the CLAUDE.md symlink are removed.
  • Project with its own rustfmt.toml and AGENTS.md: both are kept, along with the CLAUDE.md symlink pointing at them; the kit's other three files are removed.
• astro check: 0 errors. All internal links are valid.
• The workflow parses with top-level {"contents":"read"} and deploy-level {"pages":"write","id-token":"write"}. The deploy job can only run after merge, so confirm the first main deploy succeeds.