Add branded default provider and enforced enrollment

docs/lab-runbook.md

@@ -18,7 +18,8 @@ put an institutional password on a command line or in a script file.
 Set-Location C:\Users\alex\Documents\projects\SGU-CredentialProvider
 dotnet restore .\SGU-CredentialProvider.sln
 dotnet build .\SGU-CredentialProvider.sln -c Release --no-restore
-dotnet test .\SGU-CredentialProvider.sln -c Release --no-build --no-restore
+dotnet test --project .\tests\SGU.AuthBroker.Core.Tests\SGU.AuthBroker.Core.Tests.csproj -c Release
+dotnet test --project .\tests\SGU.CredentialProvider.Tests\SGU.CredentialProvider.Tests.csproj -c Release
 .\scripts\Publish-Lab.ps1
 ```
 
@@ -111,6 +112,10 @@ OU on Windows Server. Use separate authorized test accounts for `DO`, `AL`, and
 
 ## 5. Install the Credential Provider
 
+For a new client, prefer the provider-first transaction in
+[`client-enrollment.md`](client-enrollment.md). The direct installation below is
+kept for repair and existing domain members.
+
 On Windows 10:
 
 ```powershell