Enhance README with WebOperator features and setup

[KazKozDev]

Added information about WebOperator's functionality and setup.

What this changes

Why

How it was verified

• ./scripts/check.sh passes locally
• Unit tests added or updated for the changed behaviour
• Loaded core/dist in Chrome and ran the affected flow by hand
• Ran against a fixture in evals/fixtures — which one:
• Browser eval run (npm run eval:extension) — attach or summarize the trace

Checklist

• One concern per PR — no unrelated refactors bundled in
• Commit messages follow Conventional Commits
• Docs updated if behaviour, a default, a permission, or an env var changed
• CHANGELOG.md updated under Unreleased for a user-visible change

Security-sensitive areas

• The prompt-injection boundary (page content reaching the model as instructions)
• weboperator-bridge parsing, binding, or authentication
• Credential vault or trace/log masking
• Manifest permissions
• None of the above

[KazKozDev]

merge