docs(peer): document authenticated sharing architecture

Update user and developer documentation for the protocol-8 system: persistent
SPKI-derived identities, exact catalog ContentId authority, pinned responder
pulls, structured runtime ownership, direct-author Call to Play, and the global
local-network sharing switch.

Remove active descriptions of repository-wide certificates, pushed deltas,
relayed histories, and metadata consensus. Keep operational and UI boundaries
aligned with the implementation, including the fail-closed production catalog
gate.

Test Plan:
- `just fmt` (passed)
- `git diff --cached --check` (passed)

README.md

@@ -4,6 +4,18 @@ Peer-to-peer game library sharing for LAN parties. Peers discover each other on
 the local network via mDNS, exchange library metadata over QUIC, and let users
 browse and download games from each other. Ships as a Tauri desktop app.
 
+## Peer identity and protocol status
+
+Each desktop installation creates and reuses one Ed25519 identity in its Tauri
+app-data directory. Its `PeerId` is lowercase unpadded RFC 4648 base32 of BLAKE3
+over the certificate's complete canonical DER SubjectPublicKeyInfo; certificates
+and private keys are never distributed from the repository. Outbound QUIC
+connections authenticate the responder against the exact expected `PeerId`. Wire
+protocol 8 (`lanspread/8`) is the only supported protocol. Peers exchange
+responder-owned, revisioned snapshots over identity-pinned endpoints; file and
+streamed-install requests name the catalog's exact `ContentId`. There are no
+legacy wire fallbacks or repository-shared identity keys.
+
 ## Build / install
 
 Install Rust, Deno, and `just` first, then bootstrap the project:
@@ -33,12 +45,20 @@ Create production bundles:
 just bundle
 ```
 
+Development commands use the checked-in peer-CLI fixture catalog only after its
+database and manifests pass the catalog checker. Production bundles never use
+that fixture authority: `just bundle` validates the production `game.db` and
+requires a generated manifest for every catalog game before Tauri packaging can
+start. This checkout does not include the canonical production package corpus,
+so maintainers must generate and independently check those manifests beside the
+production packages before a bundle can succeed.
+
 ## Important just commands
 
 - `just setup` - install the Tauri CLI and frontend dependencies.
 - `just run` - run the Tauri app in dev mode.
 - `just build` - build the app without bundling.
-- `just bundle` - create production bundles.
+- `just bundle` - validate the complete production catalog and create bundles.
 - `just fmt` - format Rust, TOML, and the justfile.
 - `just clippy` - lint the Rust workspace.
 - `just test` - run workspace tests.