Make the one-line install survive Defender, and approval leave a PC that works

All three found testing the bootstrap installer on Windows.

- The published command used the irm-pipe-iex form, which Microsoft Defender
  detects as Trojan:Win32/Commando.A!ml and kills before it runs, every time,
  on a default install. The command now downloads the script to a file, runs
  it, and removes it in a finally block, which Defender does not object to.
  The UI also offers the script as a plain download for a tech who would
  rather save it.
- Approving a request only linked the asset, so a PC whose pending reason was
  "unknown hostname" - which is every PC installed this way - kept getting 403
  on every call afterwards, because its computer record had no hostname to
  match the credential against. Approval now stamps the hostname when the
  record has none, refuses with a 409 naming both when the record has a
  different one, and overwrites only when the admin confirms. The Credentials
  tab offers that confirmation.
- A hostname that resolves to no record now says so instead of reading as an
  impostor, while still refusing the request.
- While waiting for approval the agent retried on the 15-minute telemetry
  cadence, so a PC approved immediately enrolled a quarter of an hour later
  and the installer always ended on "still pending". It now retries about
  every minute for the first ten minutes, then every five to thirty minutes,
  then every fifteen, with jitter. A rate limit or server error still uses the
  slower backoff.

plugins/endpoints/docs/PER-PC-CREDENTIALS-ROLLOUT.md

@@ -262,7 +262,12 @@ Repeat until **Ready** is 0.
   mismatch, duplicate or unknown hostname, already enrolled, or auto-enroll
   off). Credentials tab -> Requests -> **Approve**; the picker defaults to the
   matched computer, search to choose another. The PC collects its credential on
-  its next retry (within 15 minutes). **Reject** anything you do not recognise.
+  its next retry - about a minute for a PC that started asking recently,
+  slowing to 15 minutes once it has been pending a while. **Reject** anything
+  you do not recognise. Approving also records the hostname the PC reports on
+  the computer you picked when that record has none; if the record carries a
+  DIFFERENT hostname the approval stops and asks, because the PC cannot
+  authenticate against a computer recorded under another name.
 - **Newly imaged PCs:** imaging installs 1.20 with the shared key, and the agent
   auto-enrolls on first start. A new PC can also be installed WITHOUT the
   shared key at any time, before or after cutover (the generated installer's
@@ -288,15 +293,30 @@ says so when it finds an agent already installed.
 3. On the target PC, open PowerShell **as administrator** and paste it:
 
 ```
-powershell -ExecutionPolicy Bypass -c "irm https://<server>/api/endpoints/siteagent/bootstrap.ps1?t=<token> | iex"
+powershell -ExecutionPolicy Bypass -c "try { Invoke-WebRequest -UseBasicParsing 'https://<server>/api/endpoints/siteagent/bootstrap.ps1?t=<token>' -OutFile 'C:\Windows\Temp\shopdb-bootstrap.ps1'; & 'C:\Windows\Temp\shopdb-bootstrap.ps1' } finally { Remove-Item 'C:\Windows\Temp\shopdb-bootstrap.ps1' -Force -ErrorAction SilentlyContinue }"
 ```
 
+It downloads the script, runs it and deletes it again. Do not shorten it back
+to `irm ... | iex`: Defender scores that shape as `Trojan:Win32/Commando.A!ml`
+and kills the process before anything runs, on a default install with no ASR
+rules. Paste it as one line into an elevated **cmd** or **PowerShell** window;
+it means the same in both. **Download .ps1** in the same block saves the script
+instead, for a PC where pasting a long line is awkward - it carries the same
+token, so treat the file the way you treat the command.
+
 The token is short-lived and only fetches the installer. It carries no shared
 key and provisions nothing by itself: the package it downloads is built with
 "Include shared key" off, whatever the shared-key setting is, so the PC asks to
 enroll and **waits for approval**. Approve it in Enrollment -> Credentials ->
 Requests, the same as any other pending PC (phase 5).
 
+A one-off PC is pending for `unknown hostname` by definition, so pick (or
+create) the computer record it belongs to. The approval records the hostname
+the PC reports on that record, which is what the PC authenticates against
+afterwards; picking a record already named something else stops the approval
+and asks before renaming it. Skipping that step is what used to leave a
+bootstrapped PC enrolled and then refused (403) on every call.
+
 The script checks the downloaded binaries against the SHA-256 values the server
 stamped into it, refuses to run unelevated, and refuses to run on a PC that
 already has the agent service (set `SHOPDB_BOOTSTRAP_FORCE=1` in the same