replace web iex launcher with a save-and-run script

The iex (irm ...) one-liner could never work against a private repo: raw.githubusercontent.com returns 404 without a token, and a git operation's Credential Manager auth does not apply to a plain irm. The prior token-passing workaround (get.ps1, 717387f) asked pilots to paste a PAT, which they will not do and may not have.

Start-ShopDBDev.ps1 is a downloaded FILE, not a web pipe, so only its git clone/fetch need auth - and those go through Git Credential Manager using the login pilots already have from cloning this repo or signing in via Visual Studio / VS Code. No token, no paste. It takes -Channel stable|edge and hands off to dev-bootstrap.ps1. DEV-BUILD-TEST.md is rewritten for the save-and-run flow with a GCM-seeding fallback.

scripts/Start-ShopDBDev.ps1

@@ -0,0 +1,86 @@
+<#
+.SYNOPSIS
+	Save-and-run launcher for a ShopDB dev workstation (stable or edge).
+
+.DESCRIPTION
+	Download this one file and run it. It clones (or updates) the repo at the
+	channel branch into a local path, then hands off to scripts/dev-bootstrap.ps1
+	for the real dependency-check / build / up work.
+
+	ge-aero/shopdb-flask is a PRIVATE repo, but this needs no token pasting: the
+	clone uses a plain https URL and Git Credential Manager supplies your stored
+	GitHub credential automatically - the same way `git clone` works in the wiki
+	DEVELOPMENT-SETUP procedure. If you have ever cloned this repo or signed in to
+	GitHub in Visual Studio / VS Code on this box, GCM already has what it needs.
+
+	This is a downloaded FILE, not a web `iex` one-liner, precisely because a
+	private repo cannot be fetched anonymously from raw.githubusercontent.com. A
+	saved script sidesteps that entirely - only the git operations need auth, and
+	GCM handles those.
+
+.PARAMETER Channel
+	'stable' (main) or 'edge' (dev-be). Defaults to 'stable'.
+
+.PARAMETER TargetDir
+	Where to clone. Defaults to %USERPROFILE%\shopdb-dev, a separate working copy
+	from any repo you already have open.
+
+.EXAMPLE
+	# Bleeding edge:
+	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel edge
+
+.EXAMPLE
+	# Stable:
+	powershell -ExecutionPolicy Bypass -File .\Start-ShopDBDev.ps1 -Channel stable
+
+.NOTES
+	ASCII only, no emoji or smart punctuation, per repo style. PowerShell 5.1+.
+	Needs Git (with Credential Manager, the Git-for-Windows default);
+	dev-bootstrap.ps1 offers to winget-install anything else that is missing.
+#>
+[CmdletBinding()]
+param(
+	[ValidateSet('stable', 'edge')]
+	[string]$Channel = 'stable',
+
+	[string]$TargetDir
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Plain https URL. No token in the URL: Git Credential Manager injects the
+# stored GitHub credential for github.com, so clone/fetch authenticate against
+# the private repo without anything sensitive touching this script or disk.
+$repoUrl = 'https://github.com/ge-aero/shopdb-flask.git'
+$branch = if ($Channel -eq 'edge') { 'dev-be' } else { 'main' }
+$target = if ($TargetDir) { $TargetDir } else { Join-Path $env:USERPROFILE 'shopdb-dev' }
+
+Write-Host "ShopDB dev launcher" -ForegroundColor White
+Write-Host "  Channel : $Channel ($branch)" -ForegroundColor White
+Write-Host "  Target  : $target" -ForegroundColor White
+
+if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
+	throw 'git is required. Install Git for Windows (winget install Git.Git) and re-run.'
+}
+
+if (Test-Path (Join-Path $target '.git')) {
+	Write-Host "==> Updating existing clone" -ForegroundColor Cyan
+	git -C $target fetch origin $branch
+	if ($LASTEXITCODE -ne 0) { throw "git fetch failed ($LASTEXITCODE). If this is an auth error, clone the repo once in Visual Studio / VS Code so Credential Manager stores your GitHub login." }
+	git -C $target checkout $branch
+	if ($LASTEXITCODE -ne 0) { throw "git checkout failed ($LASTEXITCODE)." }
+	git -C $target pull --ff-only origin $branch
+	if ($LASTEXITCODE -ne 0) { throw "git pull failed ($LASTEXITCODE)." }
+} else {
+	Write-Host "==> Cloning $branch" -ForegroundColor Cyan
+	git clone --branch $branch $repoUrl $target
+	if ($LASTEXITCODE -ne 0) { throw "git clone failed ($LASTEXITCODE). If this is an auth error, sign in to GitHub once in Visual Studio / VS Code (or run 'git clone $repoUrl' manually) so Credential Manager stores your login, then re-run." }
+}
+
+$bootstrap = Join-Path $target 'scripts\dev-bootstrap.ps1'
+if (-not (Test-Path $bootstrap)) {
+	throw "dev-bootstrap.ps1 not found at $bootstrap. Is the '$branch' branch correct?"
+}
+
+Write-Host "==> Handing off to dev-bootstrap.ps1" -ForegroundColor Cyan
+& $bootstrap -Channel $Channel