Set Chrome as default and pin it, as far as Windows allows

Neither can be done for the running profile: UserChoice is hash-validated and
guarded by UCPD.sys since Feb 2024, and taskbar pinning lost its shell verb
years ago - both to stop installers helping themselves. What is supported is
policy, which applies when a profile is created, so this writes the
DefaultAssociationsConfiguration and taskbar layout XMLs for the next user and
does the two things that help the current one: a desktop shortcut, and opening
the Settings page where the browser choice actually has to be made.

Folded into the enrolment script's existing elevation so the install still
raises a single UAC prompt.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/enroll-chrome-management.ps1

@@ -43,7 +43,10 @@ param(
     [switch]$NoElevate,
 
     # Fail rather than installing Chrome when it is missing.
-    [switch]$SkipChromeInstall
+    [switch]$SkipChromeInstall,
+
+    # Skip the default-browser and taskbar-pin policies.
+    [switch]$NoDesktopConfig
 )
 
 $ErrorActionPreference = 'Stop'
@@ -62,6 +65,7 @@ if (-not ([Security.Principal.WindowsPrincipal]$identity).IsInRole(
     Write-Host 'Asking for administrator rights — the enrolment token is machine-level.'
     $psArgs = @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', "`"$PSCommandPath`"", '-NoElevate')
     if ($SkipChromeInstall) { $psArgs += '-SkipChromeInstall' }
+    if ($NoDesktopConfig)   { $psArgs += '-NoDesktopConfig' }
     if ($Remove) { $psArgs += '-Remove' }
     else {
         $psArgs += @('-Token', $Token)
@@ -177,6 +181,19 @@ if ($Mandatory) {
     Write-Host 'Enrolment is now mandatory — Chrome will not start unenrolled.'
 }
 
+# Already elevated here, so folding this in keeps the whole install to one UAC
+# prompt rather than two.
+if (-not $NoDesktopConfig) {
+    $defaults = Join-Path (Split-Path -Parent $PSCommandPath) 'configure-chrome-defaults.ps1'
+    if (Test-Path $defaults) {
+        try {
+            & $defaults -Quiet
+        } catch {
+            Write-Warning "Default-browser and taskbar policies skipped: $($_.Exception.Message)"
+        }
+    }
+}
+
 Write-Host @"
 
 Next: