Merge the wilm work, act on the five-agent review, verify the launch-path policy on Windows

scripts/uninstall-shopdbagent.ps1

@@ -114,6 +114,15 @@ Start-Sleep -Seconds 1
 Write-Host "[3/6] Removing registry entries ..."
 Remove-HklmBothViews -SubKey "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "ShopDbEndpointTray"
 Remove-HklmBothViews -SubKey "SOFTWARE\GE\ShopDB"
+
+# Remove the All-Users Start Menu shortcut the site-agent installer created.
+$commonPrograms = [Environment]::GetFolderPath([Environment+SpecialFolder]::CommonPrograms)
+$shortcutPath = Join-Path $commonPrograms "ShopDB Agent.lnk"
+if (Test-Path $shortcutPath) {
+	try { Remove-Item -Path $shortcutPath -Force -ErrorAction Stop; Write-Host "  removed Start Menu shortcut $shortcutPath" }
+	catch { Write-Warning "  could not remove Start Menu shortcut: $($_.Exception.Message)" }
+}
+
 # Drop the parent GE key only if we emptied it (some sites nest siblings under
 # GE such as SFLD; never tree-delete a key we do not own).
 foreach ($view in @([Microsoft.Win32.RegistryView]::Registry64,