Bootstrap v2.2 to stable: download.autopilotmonitor.com endpoint + OOBE-relax

[okieselbach]

Summary

Promotes the field-tested -dev bootstrap script (v2.2) to be the stable script, so customers deploying Install-AutopilotMonitor.ps1 now get the new download endpoint.

• Install-AutopilotMonitor.ps1 is now the former -dev.ps1 1:1 (only the "(DEV)" markers removed):
  • agent download via the Front Door alias https://download.autopilotmonitor.com/agent/ instead of the legacy blob host
  • SHA-256 manifest verification is mandatory (legacy Content-MD5 fallback removed — no hash, no install)
  • OOBE-relax exemption for the Windows Backup for Organizations restore case (single fresh profile during in-progress OOBE no longer blocks the install)
• Test-ShouldBootstrapAgent.ps1 mirrors the same guard logic (dry-run tester)
• both -dev.ps1 files deleted
• CI dev-render anchor literals in build-agent.yml updated to the alias URLs (stable + dev channel) so the literal-substitution check keeps passing

Verification

• Both scripts: pure ASCII (0 non-ASCII bytes), 0 PowerShell parse errors
• CI anchor substitution simulated locally: dev render correctly produces AutopilotMonitor-Agent-dev.zip / version-dev.json, $ScriptVersion 2.2 parses
• No remaining -dev.ps1 references in the repo; backend BootstrapScriptValueValidator already allow-lists the alias host

Notes

• The blob copy of the script (and the docs bootstrapper badge) rotates on the next publish_as_stable release run; GitHub downloads serve v2.2 immediately after merge
• Local build.ps1 anchors updated too (gitignored, not part of this PR)
• Docs companion commit ab8cff8 in autopilotmonitor-docs (guard table + changelog entry)

🤖 Generated with Claude Code