Continuous MDM enforcement — MDM always wins over user/OS state, so
a policy pushed AFTER the fresh-install decision still takes effect.
If the admin later lifts the policy, autostart stays off until the
user re-enables it in Settings (accepted trade-off vs tracking user
intent separately).