fix(ci): render metrics with an org-scoped token and curate Pages

[ss-o]

Summary

The organization summary embedded at https://wiki.zshell.dev/docs#summary rendered
NaN members and zeroed repository totals. The cause was the token, not CI
permissions: the workflow ran green on every schedule.

lowlighter/metrics rejects GITHUB_TOKEN because it fetches data outside the
current repository, detecting it by the absence of an x-oauth-scopes header.
Four of the seven steps passed ${{ github.token }}. Evidence from run
33300567276 (conclusion: success):

step	output	token validity	API calls
1	metrics.svg	(could not verify)	REST 0 / GraphQL 0
2	repositories_metrics.svg	(could not verify)	7 / 22
3	worldmap.svg	(could not verify)	-
4	followup.svg	(could not verify)	-
5-7	*_followup.svg	seems ok	populated

Step 1 fetched nothing and still exited Success because plugins_errors_fatal
was unset. base/index.mjs assigns {totalCount: NaN} when the org field query
fails, which is the NaN members string. The three steps already using
METRICS_TOKEN rendered real figures throughout, isolating the token as the
variable.

Rendered text of the two images the wiki embeds, before this change:

• metrics.svg: Joined GitHub 4 years ago ... NaN members ... Verified
• repositories_metrics.svg: 90 Repositories, 0 Releases, 0 Packages, 0 Sponsors, 0 Stargazers, 0 Forkers, 0 Watchers

Ground truth from the API: 4 members, 88 non-fork repositories, 2124 stars,
271 forks, 95 watchers, 100 releases.

Changes

metrics.yml

• Pass METRICS_TOKEN to every step; keep GITHUB_TOKEN as committer_token.
• Set plugins_errors_fatal: yes so a failed fetch fails the run rather than
  publishing placeholder output.
• Remove the stargazers worldmap step. GOOGLE_MAP_TOKEN exists in neither
  repository nor organization secrets, so it only ever rendered
  Google Maps API token is not set.

static.yml

Pages was serving the whole repository from main via path: '.', publishing
runbooks/, decisions/, lib/ and .trunk/ while omitting the generated
SVGs entirely. Verified against the live site before this change:

200  /AGENTS.md
200  /decisions/README.md
200  /profile/img/logo.svg
404  /metrics/plugin/metrics.svg
404  /

Now stages a curated set: profile/img/** from main plus metrics/** from the
metrics branch, filtered to image extensions, with a generated index. Adds
workflow_run triggers on Z Metrics, Z Reader and Z PageSpeed Insights so new
renders reach Pages without waiting for an unrelated push to main.

Note the repository's Pages source field still reads branch: metrics, but
build_type is workflow, so that field is inert and static.yml is the real
publisher.

Related

The metrics branch was reset separately (029e83a1 -> 4fec54d3). It had been
branched from main rather than created empty, so it carried 104 stale files
frozen at 2026-05-18, including gh-deploy-assets.yml and gh-push.yml. Those
two were unreachable: absent from main, unregistered in gh workflow list,
and targeting a gh-pages branch that does not exist. All retained SVG blobs
were verified byte-identical before the push. Recovery SHA: 029e83a1.

Relates to #485.

Verification

• trunk check --filter=actionlint,shellcheck,prettier clean on both workflows;
  actionlint confirmed genuinely executing via an injected fault.
• All four new action pins verified to resolve to their claimed tags.
• Wiki-embedded raw URLs confirmed 200 after the branch rewrite.
• Post-merge: dispatch Z Metrics and confirm the rendered SVG text carries real
  figures, then confirm the SVGs are reachable on Pages.