[jpr5]

Summary

The GitHub App Setup docs told operators to grant the App Contents: Read-only for the support agent's evidence reads. We are not granting it. The evidence reads only target the public CopilotKit/CopilotKit and ag-ui-protocol/ag-ui repos, which need no Contents permission. The App is installed org-wide, so Contents would expose every private repo in the org to a bot that reads untrusted issue text and posts publicly.

#289 (merged separately) narrows the evidence token to metadata: read on the CopilotKit repo. This PR brings the docs in line:

• docs/deployment.md: drop the "grant Contents" pre-deploy step (and its "missing step 3" consequence), list permissions as Issues write, Discussions write, Metadata read, and replace the Contents explanation with a short "do not grant Contents" note.
• docs/support-agent.md: token narrowed to metadata: read; replace the "App must hold Contents" sentence with the same "do not add it" note.

Docs only, no code changes.

Before / after

Before (grep for the Contents grant instruction across docs/, README.md, apps/*/README.md):

docs/deployment.md:96:3. Grant the GitHub App **Contents: Read-only**. An org owner or a GitHub App manager adds it under the App's **Permissions & events**, an
docs/deployment.md:108:    - Permissions: **Issues: Read & write**, **Discussions: Read & write**, **Contents: Read-only**. (**Metadata: Read-only** is granted 
docs/deployment.md:111:    Contents is for the support agent's evidence reads. `read_source` and `read_release` ask GitHub for an installation token narrowed to
docs/support-agent.md:26:- `GITHUB_APP_ID`, `GITHUB_PRIVATE_KEY`, and `GITHUB_INSTALLATION_ID` — the same App credentials the rest of the worker already uses — 

After (only the new "do not grant" sentence remains):

docs/deployment.md:110:    Do not grant **Contents**. The support agent's evidence reads (`read_source`, `read_release`) only target the public CopilotKit/Copil

Live install (app_id 4309877, copilotkit-outpost-bot), matching the documented permissions:

{"discussions":"write","issues":"write","metadata":"read"}  repository_selection: all

prettier --check docs/deployment.md docs/support-agent.md: all files use Prettier code style.