Install the extension from the update server during setup

Both installers ended by telling you to load the folder unpacked, which is the
one install that can never update itself. They now offer the policy install as
a last step instead, and only fall back to those instructions when it is
declined or fails.

Windows writes to the user's own policy hive rather than HKLM, so the step
needs no elevation and no separate admin shell; -Scope Machine is still there
for every-account installs. Linux gets the counterpart script — a managed
policy file under /etc, which is root-only because Chrome reads policy from
nowhere else on that platform.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/install-extension-policy.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Install the AutoFirmer extension from our own update server, via policy.
+#
+# The Linux counterpart to install-extension-policy.ps1. Chrome reads managed
+# policy from JSON files under /etc, so unlike Windows there is no per-user
+# option here — it needs root, and it applies to everyone on the machine.
+#
+#   sudo scripts/install-extension-policy.sh            # install
+#   sudo scripts/install-extension-policy.sh --remove   # take it back off
+set -euo pipefail
+
+ID="${EXTENSION_ID:-lkjbblagjjbldlkeaaffhiopdlhniaan}"
+UPDATE_URL="${EXTENSION_UPDATE_URL:-https://ext.juicerroom.com/updates.xml}"
+FILE=autofirmer.json
+
+REMOVE=0
+[ "${1:-}" = "--remove" ] && REMOVE=1
+
+info() { printf '  %s\n' "$1"; }
+fail() { printf '\n\033[1;31mERROR: %s\033[0m\n' "$1" >&2; exit 1; }
+
+[ "$(id -u)" -eq 0 ] || fail "run this with sudo — Chrome only reads policy from /etc"
+
+# Every Chromium-family browser reads the same policy format from its own
+# directory. Only the ones actually installed are touched: creating the
+# directory for a browser that is not there would do nothing but confuse
+# whoever finds it later.
+CANDIDATES="
+/etc/opt/chrome/policies/managed
+/etc/chromium/policies/managed
+/etc/chromium-browser/policies/managed
+/etc/opt/edge/policies/managed
+/etc/brave/policies/managed
+"
+
+touched=0
+for dir in $CANDIDATES; do
+    parent=$(dirname "$(dirname "$dir")")      # e.g. /etc/opt/chrome
+    [ -d "$parent" ] || [ -d "$dir" ] || continue
+
+    if [ "$REMOVE" -eq 1 ]; then
+        if [ -f "$dir/$FILE" ]; then
+            rm -f "$dir/$FILE"
+            info "removed $dir/$FILE"
+            touched=$((touched + 1))
+        fi
+        continue
+    fi
+
+    mkdir -p "$dir"
+    # Its own file rather than an edit of someone else's: Chrome merges every
+    # JSON in this directory, so a separate file cannot corrupt a policy set by
+    # something else. Two files setting ExtensionInstallForcelist would collide,
+    # which is worth knowing if this machine is centrally managed.
+    cat > "$dir/$FILE" <<JSON
+{
+  "ExtensionInstallForcelist": ["$ID;$UPDATE_URL"]
+}
+JSON
+    chmod 644 "$dir/$FILE"
+    info "wrote $dir/$FILE"
+    touched=$((touched + 1))
+done
+
+if [ "$touched" -eq 0 ]; then
+    if [ "$REMOVE" -eq 1 ]; then
+        info "nothing to remove"
+    else
+        fail "found no Chrome, Chromium, Edge or Brave installation to configure"
+    fi
+    exit 0
+fi
+
+echo
+if [ "$REMOVE" -eq 1 ]; then
+    info "Restart the browser to let the change take effect."
+else
+    info "Next:"
+    info "  1. Remove any unpacked copy from chrome://extensions (same id — both cannot load)."
+    info "  2. Restart the browser, or open chrome://policy and press \"Reload policies\"."
+    info "  3. The card should read \"Installed by enterprise policy\"."
+fi