Website permissions — fewer prompts, same guardrails

A build is a tight loop of npm/astro/playwright/git calls. Approving each one by hand is friction with no safety benefit — those commands can't hurt you. This skill gets the repo to "quiet for the safe stuff, still asks for the dangerous stuff", and keeps it that way as the project grows.

1. Install the bundled allowlist (the 90% fix)

The new-website kit ships a curated .claude/settings.json. Copy it into the repo (this is also scaffold step 3.2 — do it here if it was skipped). This skill carries its own copy of the two files, in its templates/claude/ folder, so the step works from the copy of the skill inside a site too. In the commands below, the name in braces stands for the folder this SKILL.md is in: Claude Code fills it in; with another assistant, put that folder's path in its place.