Cover the opt-in defaulting off for both new and legacy configs (the key difference from the SSH default), and that applyMDMPolicy enables the flag from allowRemoteJobs and applies debugBundleUploadURL, rejecting a non-https override.