Stop Display bays getting machine-tool shortcuts, prompts and the S: mapper

Three fixes from the 579C144 diagnostics, all the same shape: a Display kiosk
being treated as a machine-tool bay.

desktopApps: configuring "none" produced "everything"

  "Display-Dashboard": { "desktopApps": [] }

06-OrganizeDesktop.ps1 tested $null -ne $cfgApps -AND .Count -gt 0, so an
explicitly empty list fell through to the hardcoded fallback and the kiosk was
given UDC, eDNC, NTLARS, WJ Shopfloor and Defect_Tracker shortcuts.
Get-ProfileValue returns $null only when the key is ABSENT from both the profile
and site-config, so $null is the real "not configured" signal and an empty array
means what it says. startupItems carried the same test - harmless today because
its else branch has no fallback list, but commented so the two cannot drift.

Machine-number prompt on a machine with no machine number

Register-CheckMachineNumberTask.ps1 armed 'Prompt Machine Number' (AtLogOn,
BUILTIN\Users) whenever the number was the 9999 placeholder - which is always
true on a Display, because startnet only collects a real number for machine-tool
types. A logon dialog on a kiosk with no keyboard. Now skips PC types that have
no machine number by design, and clears any stale task.

S: mapper on a share-less PC

Displays are Entra-joined with local accounts and no SFLD credentials, so mapping
S: can only fail, once per logon, forever. Run-ShopfloorSetup already gated the
CALL on $noEnforceTypes, but the bay registered it anyway at 15:07:55 with no
"Skipping" line in the log - so something in the finalization phase reaches the
registrar past that gate. Rather than chase the caller, the registrar now gates
itself and removes a stale Run entry. The call-site gate stays; this makes the
outcome correct regardless of who invokes it.

That bypass is worth understanding separately - the same pattern would defeat any
call-site gate in the finalization phase.

All three parse clean and are deployed byte-identical to the share.

playbook/shopfloor-setup/Shopfloor/Register-MapSfldShare.ps1

@@ -16,6 +16,42 @@
 
 $ErrorActionPreference = 'Continue'
 
+# PC types that are self-contained and must NOT map S:. A Display kiosk is
+# Entra-joined with local accounts and no SFLD credentials, so the mapping can
+# only ever fail - once per logon, forever.
+#
+# Run-ShopfloorSetup.ps1 already gates the CALL to this script on the same list,
+# but on 579C144 (2026-08-06) the Run entry was registered on a Display anyway:
+#
+#   [15:07:55] Set HKLM:\...\Run\GE Map SFLD Share = ...Map-SfldShare.ps1
+#
+# with no "Skipping S: drive logon mapper" in the log, so something in the
+# finalization phase reaches this script past the call-site gate. Gating here as
+# well makes the outcome correct regardless of who invokes it.
+$selfContainedTypes = @('Display', 'gea-shopfloor-display')
+$pcTypeFile = 'C:\Enrollment\pc-type.txt'
+$pcType = ''
+if (Test-Path -LiteralPath $pcTypeFile) {
+    $pcType = (Get-Content -LiteralPath $pcTypeFile -First 1 -ErrorAction SilentlyContinue)
+    if ($pcType) { $pcType = $pcType.Trim() }
+}
+if ($pcType -and ($selfContainedTypes -contains $pcType)) {
+    $d = 'C:\Logs\SFLD'
+    if (-not (Test-Path $d)) { New-Item -ItemType Directory -Path $d -Force -EA SilentlyContinue | Out-Null }
+    Add-Content -Path (Join-Path $d 'register-mapshare.log') -EA SilentlyContinue `
+        -Value ("[{0}] [INFO] PC type '{1}' is self-contained - not registering the S: mapper." -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $pcType)
+    Write-Host "PC type '$pcType' is self-contained - skipping S: drive mapper."
+    # Remove a stale entry from an earlier image or an earlier code path.
+    try {
+        $runKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
+        if ((Get-ItemProperty -Path $runKey -Name 'GE Map SFLD Share' -EA SilentlyContinue)) {
+            Remove-ItemProperty -Path $runKey -Name 'GE Map SFLD Share' -Force -EA Stop
+            Write-Host "  removed stale 'GE Map SFLD Share' Run entry."
+        }
+    } catch { }
+    return
+}
+
 $installRoot = 'C:\Program Files\GE\SfldShare'
 $mapScript   = Join-Path $installRoot 'Map-SfldShare.ps1'
 $logDir      = 'C:\Logs\SFLD'