Keep every server pin in the upgrade script, and stop promising enrollment to an enrolled PC

Found in the Windows VM check.

- The agent upgrade script wrapped Get-ShopDbServerPins in @(), which turned
  several registry pins into one joined string. During a certificate rotation
  the upgrade download would have refused the rotated server. It also merged
  appsettings pins with the registry; it now follows the agent's rule: when the
  ServerPins value exists, even empty, the registry owns the list. The shared
  pin block in the upgrade script and both reporters gains
  Test-ShopDbServerPinsValue.
- A key-less package installed over an enrolled PC printed both "existing
  enrolled credential found; kept as is" and "This PC will request
  enrollment". The enrollment notices now print only when no credential exists.

plugins/endpoints/api/siteagent.py

@@ -331,11 +331,15 @@ def _install_script(baseurl, collectorkey, cadenceseconds, certfilename=None,
         keyparam = ''
         keycheck = ''
         keywrite = (
-            'Write-Host "      no shared key in this package; the agent will request enrollment." -ForegroundColor Yellow\n')
+            'if (-not (Test-Path (Join-Path $env:ProgramData "ShopDB\\EndpointAgent\\credential\\credential.bin"))) {\n'
+            '    Write-Host "      no shared key in this package; the agent will request enrollment." -ForegroundColor Yellow\n'
+            '}\n')
         sharedkeymode = 'omitted'
         enrollnotice = (
-            'Write-Host "      This PC will request enrollment. Approve it in '
-            'Settings > Endpoints > Enrollment." -ForegroundColor Yellow\n')
+            'if (-not (Test-Path (Join-Path $env:ProgramData "ShopDB\\EndpointAgent\\credential\\credential.bin"))) {\n'
+            '    Write-Host "      This PC will request enrollment. Approve it in '
+            'Settings > Endpoints > Enrollment." -ForegroundColor Yellow\n'
+            '}\n')
     return """# install.ps1
 # ShopDB endpoint agent installer. Run from an ELEVATED (admin) PowerShell on
 # the endpoint. Provisions the registry credentials, copies the agent to