fix(shopfloor): self-healing S: drive mapper to stop mid-shift drive loss

S: was mapped once per logon (HKLM\Run -> Map-SfldShare.ps1) with no
re-check, so any SMB session break the redirector could not silently
re-authenticate left S: dead until the user logged out and back in.

Replace the Run entry with a scheduled task (BUILTIN\Users, Limited)
that fires at logon, every 3 min, on unlock/console-connect, and on
network-connect. The mapper now probes S: with a real timed directory
read (not net use output parsing, which reports a dead drive as
healthy), only repairs after two consecutive failed probes with TCP 445
reachable, and never touches a working drive. Credentials go through
New-SmbMapping / CredWrite instead of the net use command line, and a
Domain Password credential is seeded so Windows' own reconnect and UNC
access share one identity (kills the 1219 conflict class).

Register-MapSfldShare stamps HKLM\SOFTWARE\GE\SfldShare\MapperHash with
the staged script's SHA256 after success, so GE-Enforce can (re)register
it fleet-wide via a common manifest entry and re-fire on version bumps.

Verified in the win11 VM: healthy no-op with an open handle held across
runs, repair of deleted / wrong-target / present-but-unreadable drives,
unaided recovery after a NIC bounce and on the 3-min interval, and the
full SYSTEM-from-share registrar path flipping detection to installed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011boHjE3EeexwszdiKDZ7iX

playbook/shopfloor-setup/Run-ShopfloorSetup.ps1

@@ -419,10 +419,14 @@ if ($noEnforceTypes -contains $pcType) {
     Write-Warning "Register-GEEnforce.ps1 not found - no ongoing enforcement will run on this PC"
 }
 
-# Map S: drive on user logon for every account in BUILTIN\Users. The
-# vendor 'SFLD - Consume Credentials' task is principal-restricted and
-# does not fire for the ShopFloor end-user, so this parallel task fills
-# the gap. Cross-PC-type because every shopfloor account needs S:.
+# Register the 'GE Map SFLD Share' task: keeps S: alive for every account
+# in BUILTIN\Users (logon + every 3 min + unlock/console connect + network
+# up), with a real read probe and a confirm-then-repair path. The vendor
+# 'SFLD - Consume Credentials' task DOES fire for ShopFloor (principal is
+# the Users group) but maps S: once per logon only; nothing re-maps it
+# mid-shift, which is why S: stayed dead until re-logon. Our task is
+# idempotent next to it (healthy S: is never touched). GE-Enforce also
+# (re)registers it fleet-wide via the common manifest entry.
 # Display PCs skipped: kiosk user has no SFLD creds, S: map would fail
 # every logon. Self-contained Display has no share dependency.
 $registerMapShare = Join-Path $setupDir 'Shopfloor\Register-MapSfldShare.ps1'