Install the extension from the update server during setup

Both installers ended by telling you to load the folder unpacked, which is the
one install that can never update itself. They now offer the policy install as
a last step instead, and only fall back to those instructions when it is
declined or fails.

Windows writes to the user's own policy hive rather than HKLM, so the step
needs no elevation and no separate admin shell; -Scope Machine is still there
for every-account installs. Linux gets the counterpart script — a managed
policy file under /etc, which is root-only because Chrome reads policy from
nowhere else on that platform.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -132,14 +132,21 @@ pick it up from the server.
 select the `extension` folder.
 
 That is the development install. On a machine that just runs trades, install it
-from our own update server instead — one elevated command, and Chrome then keeps
-it updated by itself:
+from our own update server instead, and Chrome keeps it updated by itself — the
+setup scripts offer this as their last step, and it can be run on its own at any
+time:
 
 ```powershell
 powershell -NoProfile -ExecutionPolicy Bypass -File scripts\install-extension-policy.ps1
 ```
 
-See [deploy/README.md](deploy/README.md). Either way the extension notices when
+```bash
+sudo scripts/install-extension-policy.sh
+```
+
+No administrator rights on Windows, where it goes into the user's own policy
+hive; root on Linux, where Chrome only reads policy from `/etc`. See
+[deploy/README.md](deploy/README.md). Either way the extension notices when
 the dashboard is running newer code than it is: a policy install asks Chrome to
 fetch the new CRX, an unpacked one reloads itself from disk. Clicking the reload
 icon on its card still works and is the thing to try when something looks