CMM/DODA: enable on bays 4/10/11/12, fix PCTypes match, grant PreProcess ACL

Three fixes so DODA actually deploys on the four bays that need it:

- cmm-bay-config.csv: doda=yes for CMM4, CMM10, CMM11, CMM12 (was no on all
  bays). Drives doda.txt -> startnet pc-subtype.txt=doda -> the cmm-doda path.
- cmm-manifest.json: DODA entry PCTypes "cmm-doda" -> "gea-shopfloor-cmm-doda".
  The old value never matched: Test-PCTypeMatches builds the PC identity set as
  {gea-shopfloor-cmm, gea-shopfloor-cmm-doda, CMM} (the alias of the cmm type is
  bare CMM, no subtype variant), so "cmm-doda" was in no set and the entry was
  silently skipped. Must be the exact Type-SubType string.
- Install-DODA.ps1: grant Users + Authenticated Users Full on C:\Apps\DODA\
  PreProcess (icacls, SIDs, OI/CI inherit), applied every run. MergeFiles.exe
  writes there as the locked-down operator; without it the merge step fails.

Not yet pushed to the SFLD/enrollment share (server unreachable at commit time).
Not smoke-tested - no pwsh available here; logic-traced only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-cmm/cmm-bay-config.csv

@@ -2,12 +2,12 @@ cmm_id,pcdmis_version,doda,part_group
 CMM1,2019,no,S:\CMM\CMM1\HPTCMM1
 CMM2,2019,no,S:\CMM\CMM2\HPT
 CMM3,2019,no,S:\CMM\CMM3\VENTURE_CMM3
-CMM4,2016,no,S:\CMM\CMM4\Spool
+CMM4,2016,yes,S:\CMM\CMM4\Spool
 CMM5,2019,no,S:\CMM\CMM5\BLISKCMM5
 CMM6,2019,no,S:\CMM\CMM6\BLISKCMM6
 CMM7,2019,no,S:\CMM\CMM7\VENTURE_CMM7
 CMM8,2019,no,S:\CMM\CMM8\Venture CMM8
 CMM9,2019,no,S:\CMM\CMM9\BLISKCMM9
-CMM10,2016,no,S:\CMM\CMM10\Spool
-CMM11,2026,no,S:\CMM\CMM11\Spool
-CMM12,2026,no,S:\CMM\CMM12\Spool
+CMM10,2016,yes,S:\CMM\CMM10\Spool
+CMM11,2026,yes,S:\CMM\CMM11\Spool
+CMM12,2026,yes,S:\CMM\CMM12\Spool