Bake in the enrolment token, and install Chrome when missing

Setup asked for a token that is the same on every machine - a token is reusable
and enrols any number of browsers - so it is a default in both scripts now and
step 7 is a plain yes/no. It is a modest secret: it lets someone enrol their own
browser into the org and nothing more, and rotating it is a console click and a
one-line change.

Both scripts also install Chrome if it is absent, from Google's enterprise MSI
and the official .deb, since enrolling a browser that is not there writes a
token nothing reads. Chromium is refused rather than substituted: no cloud
management, so it could never be enrolled - and on ARM, where Chrome is not
published at all, the Linux script says so instead of installing something that
cannot do the job.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -135,13 +135,20 @@ the console already set to force install, and Chrome keeps it updated. Run on
 its own at any time:
 
 ```powershell
-powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1 -Token <token>
+powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1
 ```
 
 ```bash
-sudo scripts/enroll-chrome-management.sh <token>
+sudo scripts/enroll-chrome-management.sh
 ```
 
+The enrolment token is built into both scripts — a token is reusable across any
+number of machines — so there is nothing to type. Pass one explicitly to use a
+different org. Chrome itself is installed first if the machine hasn't got it,
+from Google's own enterprise MSI on Windows and the official .deb on Linux;
+Chromium is not accepted as a substitute, because it has no cloud-management
+support and can never be enrolled.
+
 **Enrolment is not optional.** No Chromium browser will force-install an
 off-store extension on an unmanaged machine, whatever the registry says — it
 reads the policy and blanks it. Enrolling is what makes Chrome managed without