Add GE-Enforce agent deployment: Install-GEEnforce.ps1 + deploy doc

Closes the "how do sites actually deploy GE-Enforce" gap (esp. OOBE-ppkg sites
without a PXE/WinPE step). Site-neutral + imaging-path independent.

- plugins/geenforce/client/Install-GEEnforce.ps1: a bootstrap that writes the
  PC's identity (C:\Enrollment\pc-type.txt is what determines the PC type; plus
  machine-number/cmm version/cmm id/site-config as needed), sets the shopdb
  BaseUrl + token in HKLM:\SOFTWARE\GE\ShopDB, deploys the client kit, optionally
  copies the engine from -EngineSource, and registers the SYSTEM scheduled task
  (at logon + every N min). Idempotent; fails loud (installer, not the fail-safe
  runtime). Engine is REFERENCED not vendored - it belongs to the GE-Enforce
  framework; the script warns if absent but still labels the PC.
- docs/GE-ENFORCE-DEPLOY.md: the deploy contract - the three things a PC needs
  (client, identity, credential), the identity table (what determines PC type,
  no auto-detection - the provisioner supplies it; shopdb cannot set it at
  imaging), and how to invoke per path (PXE step, OOBE ppkg via
  ProvisioningCommands, Intune, manual), the engine boundary, and verification.
- Cross-linked from docs/GE-ENFORCE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/GE-ENFORCE.md

@@ -324,4 +324,6 @@ All in GE-Enforce > Manifests. No PowerShell, no editing JSON on the share.
 - Behavioral parity gate (proves the shopdb model round-trips the real
   manifests): `plugins/geenforce/parity.py` + `flask geenforce parity`.
 - Client kit + contract: `plugins/geenforce/client/`, `docs/GE-ENFORCE-CLIENT.md`.
+- Agent deployment (per PC, any imaging path): `docs/GE-ENFORCE-DEPLOY.md` +
+  `plugins/geenforce/client/Install-GEEnforce.ps1`.
 - Design + cutover plan: `docs/proposals/ge-enforce-plugin.md`.