CMM/DODA: enable on bays 4/10/11/12, fix PCTypes match, grant PreProcess ACL

Three fixes so DODA actually deploys on the four bays that need it:

- cmm-bay-config.csv: doda=yes for CMM4, CMM10, CMM11, CMM12 (was no on all
  bays). Drives doda.txt -> startnet pc-subtype.txt=doda -> the cmm-doda path.
- cmm-manifest.json: DODA entry PCTypes "cmm-doda" -> "gea-shopfloor-cmm-doda".
  The old value never matched: Test-PCTypeMatches builds the PC identity set as
  {gea-shopfloor-cmm, gea-shopfloor-cmm-doda, CMM} (the alias of the cmm type is
  bare CMM, no subtype variant), so "cmm-doda" was in no set and the entry was
  silently skipped. Must be the exact Type-SubType string.
- Install-DODA.ps1: grant Users + Authenticated Users Full on C:\Apps\DODA\
  PreProcess (icacls, SIDs, OI/CI inherit), applied every run. MergeFiles.exe
  writes there as the locked-down operator; without it the merge step fails.

Not yet pushed to the SFLD/enrollment share (server unreachable at commit time).
Not smoke-tested - no pwsh available here; logic-traced only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-cmm/Install-DODA.ps1

@@ -39,6 +39,16 @@ if (-not (Test-Path $preProcess)) {
     Write-Host "Created $preProcess"
 }
 
+# MergeFiles.exe writes into PreProcess\ at runtime AS THE LOCKED-DOWN OPERATOR,
+# not admin. Without write access the GetDoDAFolder/merge step fails. Grant
+# Users + Authenticated Users Full (object+container inherit). SIDs, not names,
+# to stay locale-independent. Applied every run so it re-asserts after any
+# lockdown pass that strips the ACE.
+foreach ($sid in '*S-1-5-32-545','*S-1-5-11') {   # BUILTIN\Users, NT AUTHORITY\Authenticated Users
+    & icacls $preProcess /grant "${sid}:(OI)(CI)F" /T /C 2>&1 | Out-Null
+}
+Write-Host "Granted Users + Authenticated Users Full on $preProcess"
+
 if (Test-Path (Join-Path $installDir 'DovetailAnalysis.exe')) {
     Write-Host "DovetailAnalysis.exe verified present"
     exit 0