Add time-bounded burst scans

docs/ocsentinel-deployment.md

@@ -39,12 +39,21 @@ The installer creates two Windows Scheduled Tasks running as `SYSTEM`:
   `04:00` and `06:59`, derived from its Windows `MachineGuid`. This distributes
   a fleet rollout instead of sending all reports at the same time.
 - `OCSentinel Burst Check`: runs every five minutes. It performs no scan unless
-  the NinjaOne device custom field `ocsentinelburst` is enabled.
+  the NinjaOne device custom field `ocsentinelburst` is enabled. Once enabled,
+  it scans for two hours and then disables itself automatically.
 
 Create `ocsentinelburst` as a device-level `Checkbox` custom field and allow
-automation read access. Set it to `true` for a device to begin the five-minute
-burst scans; clear it to stop them. The normal daily scan continues regardless
-of the checkbox.
+automation read and write access. Set it to `true` for a device to begin the
+five-minute burst scans; clear it to stop them early. The normal daily scan
+continues regardless of the checkbox.
+
+Create these accompanying device custom fields and allow automation write
+access:
+
+| Field name | Type | Purpose |
+| --- | --- | --- |
+| `ocsentinelburstuntilutc` | Date/Time | UTC time at which the active burst ends |
+| `ocsentinelburststatus` | Text | `idle`, `active until ...`, or `completed` |
 
 ## Upload Reliability And Client Health