Stop Display bays getting machine-tool shortcuts, prompts and the S: mapper

Three fixes from the 579C144 diagnostics, all the same shape: a Display kiosk
being treated as a machine-tool bay.

desktopApps: configuring "none" produced "everything"

  "Display-Dashboard": { "desktopApps": [] }

06-OrganizeDesktop.ps1 tested $null -ne $cfgApps -AND .Count -gt 0, so an
explicitly empty list fell through to the hardcoded fallback and the kiosk was
given UDC, eDNC, NTLARS, WJ Shopfloor and Defect_Tracker shortcuts.
Get-ProfileValue returns $null only when the key is ABSENT from both the profile
and site-config, so $null is the real "not configured" signal and an empty array
means what it says. startupItems carried the same test - harmless today because
its else branch has no fallback list, but commented so the two cannot drift.

Machine-number prompt on a machine with no machine number

Register-CheckMachineNumberTask.ps1 armed 'Prompt Machine Number' (AtLogOn,
BUILTIN\Users) whenever the number was the 9999 placeholder - which is always
true on a Display, because startnet only collects a real number for machine-tool
types. A logon dialog on a kiosk with no keyboard. Now skips PC types that have
no machine number by design, and clears any stale task.

S: mapper on a share-less PC

Displays are Entra-joined with local accounts and no SFLD credentials, so mapping
S: can only fail, once per logon, forever. Run-ShopfloorSetup already gated the
CALL on $noEnforceTypes, but the bay registered it anyway at 15:07:55 with no
"Skipping" line in the log - so something in the finalization phase reaches the
registrar past that gate. Rather than chase the caller, the registrar now gates
itself and removes a stale Run entry. The call-site gate stays; this makes the
outcome correct regardless of who invokes it.

That bypass is worth understanding separately - the same pattern would defeat any
call-site gate in the finalization phase.

All three parse clean and are deployed byte-identical to the share.

playbook/shopfloor-setup/Shopfloor/06-OrganizeDesktop.ps1

@@ -330,7 +330,16 @@ function Add-ShopfloorToolsApps {
     #   Kind = 'existing'  -> copy an existing .lnk via Find-ExistingLnk
     $cfgApps = Get-ProfileValue 'desktopApps'
 
-    if ($null -ne $cfgApps -and $cfgApps.Count -gt 0) {
+    # An EMPTY configured list means "no desktop apps" and must be honoured.
+    # Get-ProfileValue returns $null only when the key is absent from both the
+    # profile and site-config, so $null is the real "not configured" signal.
+    #
+    # The old test also required .Count -gt 0, which meant "desktopApps": []
+    # fell through to the hardcoded shopfloor list below - so a Display kiosk,
+    # which explicitly configures an empty list, was given UDC, eDNC, NTLARS,
+    # WJ Shopfloor and Defect_Tracker shortcuts. Configuring "none" produced
+    # "everything". Observed on 579C144, 2026-08-06.
+    if ($null -ne $cfgApps) {
         $apps = @($cfgApps | ForEach-Object {
             $entry = @{ Name = $_.name; Kind = $_.kind }
             if ($_.kind -eq 'exe')      { $entry.ExePath    = $_.exePath }
@@ -556,6 +565,9 @@ if (Test-Path -LiteralPath $overridesPath) {
 
 $cfgStartup = Get-ProfileValue 'startupItems'
 
+# Same rule as desktopApps: $null = not configured, empty array = configured as
+# none. Harmless here today because the else branch has no hardcoded fallback,
+# but kept consistent so the two keys cannot drift apart again.
 if ($null -ne $cfgStartup -and $cfgStartup.Count -gt 0) {
     if (-not (Test-Path $startupDir)) {
         New-Item -ItemType Directory -Path $startupDir -Force | Out-Null