docs: the video's link is its Gitea page, not the raw URL, which its own CSP blocks

Checked the way a browser does it rather than the way curl does, and curl had given a false green:
Gitea sends `Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox` with
every /raw/ response. That is deliberate - it is what makes serving raw HTML and SVG safe - but it
also blocks the media load when a browser navigates straight to a video, so the tab stays blank with
no error. The same URL plays fine as a subresource, which is exactly why the file's page in Gitea
shows a player: that page embeds <video controls src=".../raw/branch/main/...mp4">.

So the declaration's link is the /src/ page URL, and /raw/ is documented as the curl-and-download
URL instead. Everything verified about both URLs is written down in step 5 - including the two ways
to get a player with no Gitea chrome around it, if that is ever wanted: an unlisted YouTube upload,
or dropping the header for this one path on the Gitea host's Caddy proxy, which must stay scoped to
store-assets/ precisely because that header is what protects raw HTML and SVG.

The file itself was never the problem: 200, video/mp4, Content-Disposition: inline, bytes
sha256-identical to the recording, and Range: bytes=0-99 -> 206 with the matching Content-Range.

README.md

@@ -192,8 +192,10 @@ device, the tablet sets on AOSP AVDs; see [docs/STORE_LISTING.md](docs/STORE_LIS
 `python3 tools/make-demo-photos.py` draws the synthetic photo library the results screenshot is
 captured over, so the listing never shows a real one. The finished assets are **committed** —
 including the foreground-service demonstration video that [the declaration](docs/PLAY_RELEASE_CHECKLIST.md)
-links to — and Gitea serves them without a login (`…/raw/branch/main/store-assets/…`), so pushing
-is the deployment step and that URL is the link itself.
+links to — and Gitea serves them without a login, so pushing is the deployment step:
+`…/src/branch/main/store-assets/…` is the page a browser opens (and the shape Play's video link
+takes, because a `/raw/` URL carries a `default-src 'none'` CSP that stops a video playing inline),
+`…/raw/branch/main/…` is the bytes.
 
 User-visible changes are tracked in [CHANGELOG.md](CHANGELOG.md); the Play "What's new"
 text you type per release is separate and lives only in the Play Console.