Enrol Chrome from the installers, and drop load-unpacked

Both setup scripts ended by telling you to load the folder unpacked, which is
the one install that cannot update itself - and the policy install they moved
to next does nothing on an unmanaged machine. Enrolment is the step that
actually matters: with it, the extension arrives from the Admin console already
force-installed, and there is nothing else to configure on the box.

So step 7 now asks for an enrolment token instead. The Windows script elevates
itself for it - the token is machine-scoped, and that is the only UAC prompt in
the whole install.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/enroll-chrome-management.ps1

@@ -30,7 +30,11 @@ param(
     [switch]$Mandatory,
 
     [Parameter(Mandatory = $true, ParameterSetName = 'Remove')]
-    [switch]$Remove
+    [switch]$Remove,
+
+    # Fail instead of asking for elevation. Also the loop-breaker: the elevated
+    # copy is launched with this set, so it can never spawn another.
+    [switch]$NoElevate
 )
 
 $ErrorActionPreference = 'Stop'
@@ -38,7 +42,25 @@ $ErrorActionPreference = 'Stop'
 $identity = [Security.Principal.WindowsIdentity]::GetCurrent()
 if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
         [Security.Principal.WindowsBuiltInRole]::Administrator)) {
-    throw 'Run this from an elevated PowerShell — the enrolment token is machine-level.'
+    if ($NoElevate) {
+        throw 'Run this from an elevated PowerShell — the enrolment token is machine-level.'
+    }
+
+    # Relaunch elevated rather than making the caller do it. setup-windows.bat
+    # runs unelevated on purpose — nothing else it does needs admin — so this is
+    # the one UAC prompt in the whole install, and it is raised here where the
+    # arguments are already parsed and can be passed on intact.
+    Write-Host 'Asking for administrator rights — the enrolment token is machine-level.'
+    $psArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-NoElevate')
+    if ($Remove) { $psArgs += '-Remove' }
+    else {
+        $psArgs += @('-Token', $Token)
+        if ($Mandatory) { $psArgs += '-Mandatory' }
+    }
+
+    $elevated = Start-Process -FilePath (Get-Process -Id $PID).Path -Verb RunAs -Wait -PassThru `
+                              -ArgumentList $psArgs
+    exit $elevated.ExitCode
 }
 
 $key = 'HKLM:\SOFTWARE\Policies\Google\Chrome'