feat(installer): refuse to damage an installation it did not create

Two guards for a server deployed by hand, which the West Jefferson production
box is.

An existing venv is reused, which is right for a repair or an upgrade of an
install this made, and wrong when the venv belongs to a different Python. The
wheelhouse is tagged for one minor version, so pip finds no candidate for the
compiled packages and dies partway through - after Python has been installed and
the application tree replaced. The two versions are now compared up front and
the run stops with both numbers and what to do about it.

Switching deployment method removes the other method's IIS artifact. That is
correct when this installer owns both and dangerous when it does not: a wrong
-MountAlias would call Remove-WebApplication on a live mount with no prompt and
no error, and the first sign would be the site returning 404. It now refuses
unless a version stamp shows this installer made the install, or -AdoptExisting
is passed, and the refusal lists exactly what it would have removed.

deploy/windows/installer/README.md

@@ -115,6 +115,30 @@ Verifying a live server, months later and offline:
 shopdb-admin.ps1 verify
 ```
 
+## Servers this installer did not build
+
+It is built for greenfield: its own Python, its own venv, its own IIS objects.
+Its upgrade path assumes the thing being upgraded came out of a previous run.
+Two guards keep it from damaging a server that was deployed by hand.
+
+**Python minor version.** An existing venv is reused, which is right for a repair
+or an upgrade. It is wrong when the venv belongs to a different Python - the
+wheelhouse is tagged for one minor version, so pip would die at the first
+compiled package, *after* Python was installed and the app tree replaced. The
+installer compares the two up front and stops with both version numbers.
+
+**IIS objects.** Switching deployment method removes the other method's artifact,
+which is correct when the installer owns both and dangerous when it does not: a
+wrong `-MountAlias` would delete a live mount with no prompt. It now refuses
+unless there is a version stamp proving it made the install, or you pass
+`-AdoptExisting`. The refusal lists exactly what it would have removed.
+
+An existing `web.config` is never overwritten in either case.
+
+For the West Jefferson production server specifically, this is a **migration, not
+an upgrade** - prod runs Python 3.13 against a hand-built deployment, so it needs
+a deliberate window, a database backup, and web.config reconciled by hand.
+
 ## Client IP addresses
 
 IIS does not set `X-Forwarded-For` on its own, and HttpPlatformHandler connects