feat: play .deck in the browser, and publish the docs

[spacedevin]

Two additions, both host-side, so the language package stays what it says it is.

@spacedevin/deck-player

Web Audio playback, as a second package in this repo. The parser is deliberately parse-only — absent optionals stay null and nothing is clamped, because that is host policy. This package is that host: defaults, clamps, synthesis, transport, plus a <deck-player> element.

The synths are a source-level port of Deckard's, which are already Tish and already pure functions, cross-checked against tish-gba's build-time bake. That means real hardware behaviour rather than an impression of it — the four DMG duty tables, a genuine 15/7-bit LFSR, 4-bit wave RAM, the 64/32 Hz frequency floors, the GBA's 256-step DAC staircase and ~16 kHz mixing roll-off.

All 62 songs in the tish-gba corpus parse with zero errors and zero substituted generators.

Three fidelity bugs found on the way

• An unrecognised duty produced a constant -1.0 buffer — a silent channel — where the bake falls back to 50%.
• Notes past * N are legal and extend the pattern (the bake computes the span as max(note ends, bars*4)). Rejecting them silenced 10 of those 62 songs.
• The GBA host extensions wave and layer were unregistered, so a sixth of the corpus reported unexpected top-level: wave and played a generic saw instead of its own wave table.

Deliberate deviations from Deckard

• Voices return their cleanup instead of arming a per-note setTimeout — wall-clock timers are wrong for an OfflineAudioContext render and untestable in Node.
• The reverb impulse is seeded, so two renders of one song match.
• Players are exclusive by default (starting one stops the others) and share a single page-level AudioContext.

Unported generators (matrixFm, patch, nes2a03, …) fall back to a plain oscillator and say so in song.substitutions. ttsVocal/meSpeakVocal are out of scope — they need the Web Speech API.

Docs site

site/ renders the markdown already in this repo to https://spacedevin.github.io/deck/. Adding a page means adding a .md file — no route, no nav entry. Sources are read in place, because docs/*.md are package exports and a content/ copy would fork the canonical text.

• .deck highlighting comes from this package's own isKeyword / isStepToken / classifyLine rather than a second keyword list, so it can't drift from the language.
• A block gets a play button when it actually parses into something audible — so note <midi> <startBeat> notation never offers one it can't honour.
• llms.txt and llms-full.txt are generated from the same pages, so they can't fall behind.

docs/EXAMPLES.md is new: eight complete runnable songs, one per idea, all clean and all playable on the site.

Tests

44 player tests (Song IR over the conformance corpus, pure timing math, and a recording fake AudioContext asserting the scheduled graph). The language package is untouched and still passes at 100% line/function/statement coverage. No conformance cases were added — that corpus is the cross-implementation contract and a new case would force every profile to declare its position.

Before merge

Both packages release in lockstep from one tag. @spacedevin/deck-player needs its own npm trusted-publisher entry before the first publish, since trusted publishers are per package.

Pages is already set to build_type: workflow, so merging this deploys the site.