fix(review): resolve whole-branch review findings (docs/config hygiene)

- docs-deploy.yml: map GOATCOUNTER_CODE into the Build env so the cookieless
  beacon actually activates when the maintainer sets the variable (was a
  producer-without-consumer gap that silently disabled docs traffic)
- MAINTAINER_ACTIONS.md: rewrite the stats section to match the shipped private
  design (drop the stale 'grant Actions write + commit data.json' over-priv item,
  add the required STATS_GITHUB_TOKEN PAT, fix the social-preview note)
- docusaurus.config.js: wire favicon-32.png (was an orphaned generated asset)
- lowercase 3 stray 'MCP For Unity' refs in roslyn.md / migrations/v6.md
- remove internal docs/superpowers/ spec+plan scratch from the PR (contradicted
  the shipped Ocean/private design); gitignore superpowers artifacts

Whole-branch review: 6/6 Critical/Important confirmed, 0 refuted, all docs/config
hygiene — build/tests/security/correctness all clean. These are the fixes.

Claude-Session: https://claude.ai/code/session_01XFiuAUxNS9riUJFFBEHvui

Author: Shutong Wu

.github/workflows/docs-deploy.yml

@@ -70,6 +70,11 @@ jobs:
 
       - name: Build
         working-directory: website
+        env:
+          # Inject the cookieless GoatCounter beacon when provisioned. The site
+          # gates on process.env.GOATCOUNTER_CODE, which Actions does NOT
+          # auto-expose — the Actions variable must be mapped in explicitly.
+          GOATCOUNTER_CODE: ${{ vars.GOATCOUNTER_CODE }}
         run: npm run build
 
       - name: Upload Pages artifact

.gitignore

@@ -69,3 +69,7 @@ tools/.unity-check-logs/
 # Ignore the .claude directory, since it might contain local/project-level setting such as deny and allowlist.
 /.claude
 .mcp.json
+
+# Superpowers skill working artifacts (specs, plans, SDD ledger)
+docs/superpowers/
+.superpowers/

docs/MAINTAINER_ACTIONS.md

@@ -10,7 +10,7 @@ cannot be committed to the repository. Complete these after the PR lands on
 
 - [ ] **Upload the GitHub social preview image.**
   Go to: `https://github.com/CoplayDev/unity-mcp` → Settings → Social preview.
-  Upload: `website/static/img/github-social-preview.png` (1280×640, generated by `npm run gen:brand`).
+  Upload: `website/static/img/github-social-preview.png` (2560×1280, 2:1 — rendered from the brand HTML templates, not `gen:brand`).
 
 - [ ] **Set repository topics.**
   Suggested topics: `unity`, `mcp`, `model-context-protocol`, `ai`, `gamedev`,
@@ -51,28 +51,31 @@ cannot be committed to the repository. Complete these after the PR lands on
 
 ---
 
-## GoatCounter (cookieless analytics)
+## Adoption analytics (private, maintainer-only)
 
-- [ ] **Create a GoatCounter account** at [goatcounter.com](https://www.goatcounter.com/)
-  for the docs site (`coplaydev.github.io/unity-mcp`).
+The daily stats workflow (`.github/workflows/stats.yml`) is **read-only** — it posts a
+unified table to the **GitHub Actions run summary** (collaborators only) and never commits.
+Leave the repo's default workflow permissions at read-only; do **not** enable repo-wide
+"Read and write".
 
-- [ ] **Generate an API token** from the GoatCounter dashboard
-  (Settings → API tokens → Create token with `readonly` scope for stats queries).
+- [ ] **Provision the GitHub traffic PAT** (powers the dashboard's lead "real-user" rows —
+  unique repo cloners/viewers). Create a fine-grained PAT scoped to `CoplayDev/unity-mcp`
+  with **Repository permissions → Administration: read**, then add it as a repository
+  **secret** `STATS_GITHUB_TOKEN`. (The default `GITHUB_TOKEN` returns 401 on the traffic API,
+  so without this PAT those rows render `—`.)
 
-- [ ] **Add GitHub Actions secrets** in the `CoplayDev/unity-mcp` repository
-  (Settings → Secrets and variables → Actions → New repository secret):
-  - `GOATCOUNTER_TOKEN` — the API token from the step above
-  - `GOATCOUNTER_SITE` — the GoatCounter site code (the subdomain, e.g. `unity-mcp`)
+- [ ] **(Docs traffic) Create a GoatCounter account** at [goatcounter.com](https://www.goatcounter.com/)
+  for the docs site (`coplaydev.github.io/unity-mcp`); keep its dashboard **private**.
 
-- [ ] **Grant Actions write permission** so the daily stats workflow can commit
-  `website/static/stats/data.json`.
-  Go to: Settings → Actions → General → Workflow permissions → Read and write permissions.
+- [ ] **Generate a GoatCounter API token** (Settings → API tokens → `readonly` scope) and add
+  two repository **secrets**:
+  - `GOATCOUNTER_TOKEN` — the API token
+  - `GOATCOUNTER_SITE` — the site code (subdomain, e.g. `unity-mcp`)
 
-- [ ] **Set `GOATCOUNTER_CODE`** in the docs deployment environment (or Docusaurus
-  build step) so the cookieless beacon is injected:
-  ```
-  GOATCOUNTER_CODE=<your-site-code>
-  ```
+- [ ] **Add `GOATCOUNTER_CODE` as an Actions _variable_** (Settings → Secrets and variables →
+  Actions → Variables) with the same site code. It is already wired in:
+  `.github/workflows/docs-deploy.yml`'s Build step maps it from `vars.GOATCOUNTER_CODE`, so once
+  the variable is set the cookieless beacon is injected on the next docs deploy.
 
 ---
 

docs/superpowers/plans/2026-06-27-repo-revamp.md

@@ -24,7 +24,7 @@ Most users don't need this. Enable it when:
 
 The installer downloads the required NuGet packages, places the DLLs in `Assets/Plugins/Roslyn/`, and adds `USE_ROSLYN` to Scripting Define Symbols.
 
-You can also trigger it from the menu: **Window → MCP For Unity → Install Roslyn DLLs**.
+You can also trigger it from the menu: **Window → MCP for Unity → Install Roslyn DLLs**.
 
 ## Manual install (if the installer isn't available)