docs: say what the player does, and a guide for packages you did not make

[alekswebnet]

Closes #26.

README

A What it does section now sits between the intro and Which setup. It has one line per capability, each linking to its guide:

• plays the packages people have: streaming, hosts without Range, the library pack, old content upgraded;
• validates what it plays: untrusted, the content check, and the entry-name and library checks every package gets;
• gives results you can audit: revision, finished, cmi5, resume;
• works offline, in the learner's language;
• comes with tools for pipelines: verify, normalize, embed, skills;
• is tested where it runs: three engines, and every content type in the pack.

The new guide is first in Guides, and the untrusted paragraph under Which setup links to it.

docs/untrusted.md, "Packages you did not make"

• What's withheld: the package's library folders, non-content file types, sniffing, and 'self' in the script policy.
• The content check: what it does to each kind of field, and why it's needed even with the code withheld. It also records how the port was compared with the PHP original (98 cases, 96 identical) and that it fails closed on runtimes older than 0.2.
• When a package is refused: with an example that asks the visitor before playing it trusted when missingLibraries.carried is set.
• Checks every package gets, untrusted or not: entry names, and the library tree.
• What it doesn't cover: your libraries are your code; the Firefox difference; Embed for sites with signed-in users; correctness is h5p-verify's job.

Other docs

• docs/frame-csp.md and docs/libraries.md point to the new guide. The CSP guide no longer describes the check itself.
• AGENTS.md lists the new guide.

Release

None now. The README reaches npm with the next player release.

Not changed

The demo site's own pages, setup.html and compare.html, still describe untrusted as they did. Updating them is a separate change.

🤖 Generated with Claude Code