Script the Chrome Enterprise Core enrolment

Enrolling is what lifts the off-store restriction without joining a domain, and
it is one machine-scoped token in both places Chrome looks: HKLM on Windows, a
file under /etc/opt/chrome/policies/enrollment on Linux. Both scripts take
--remove, and both say plainly that removing the token locally does not release
the seat in the Admin console.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/README.md

@@ -124,8 +124,23 @@ is one of:
   disk when the dashboard reports a newer version, and the updater has already
   pulled those files. Works today, any browser, nothing to enrol.
 - **Enrol Chrome in Chrome Enterprise Core** (free, and it does not require a
-  domain-joined machine): one `CloudManagementEnrollmentToken` registry value
-  makes the browser managed, and everything here then works as designed.
+  domain-joined machine): one `CloudManagementEnrollmentToken` makes the browser
+  managed, and everything here then works as designed. Generate a token in the
+  Admin console under Devices > Chrome > Managed browsers, then:
+
+  ```powershell
+  powershell -NoProfile -ExecutionPolicy Bypass -File scripts\enroll-chrome-management.ps1 -Token <token>
+  ```
+
+  ```bash
+  sudo scripts/enroll-chrome-management.sh <token>
+  ```
+
+  Both need admin/root — the token is machine-scoped — and both are Chrome only;
+  Chromium has no cloud-management support and Edge is not covered by any of
+  this. Once enrolled you can either keep using `install-extension-policy`, or
+  force-install the extension from the Admin console instead, which reaches
+  every enrolled machine at once.
 - **Publish to a web store.** Store-hosted extensions update themselves with no
   policy at all — at the price of a listing and a review on every release.