fix(shopfloor): S: mapper review fixes - headless task, drift guard, pre-flight, re-seed

Independent review in the win11 VM found four things worth fixing before
the fleet sync:

- The task action ran powershell -WindowStyle Hidden, which on Win11
  (Windows Terminal as console host) flashes a window and steals
  foreground for ~0.5 s on every fire. Action is now
  conhost.exe --headless powershell.exe ..., verified silent.
- If the share copy of Map-SfldShare.ps1 changes without the manifest
  DetectionValue being bumped, the engine calls the registrar every
  cycle. The registrar now takes an idempotent fast path (staged hash
  matches, task present with our action -> re-stamp and exit, no task
  churn) and logs one WARN per hash when -ExpectedHash disagrees with
  the share file.
- Replacing a wrong or unreadable mapping now pre-flights the new
  mapping on a spare letter and keeps the old S: when that fails
  (except on 1219, where the old session is what blocks the new one).
- Credential Manager is re-seeded whenever the HKLM credential changes
  (password rotation) and after every repair, instead of once per
  profile. Set-State no longer wipes the stored hash on suspect writes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011boHjE3EeexwszdiKDZ7iX

playbook/shopfloor-setup/Shopfloor/Register-MapSfldShare.ps1

@@ -11,7 +11,10 @@
 
 param(
     [int]$IntervalMinutes = 3,
-    [string]$InstallRoot = 'C:\Program Files\GE\SfldShare'
+    [string]$InstallRoot = 'C:\Program Files\GE\SfldShare',
+    # SHA256 the manifest entry detects on. When it differs from the share
+    # file the manifest was not bumped with the script; warn loudly once.
+    [string]$ExpectedHash = ''
 )
 
 $ErrorActionPreference = 'Continue'
@@ -32,8 +35,6 @@ function Write-RegLog {
     Write-Host $line
 }
 
-Write-RegLog '=== Register-MapSfldShare start ==='
-
 # Self-contained PC types never get S: (Display kiosk: local accounts, no
 # SFLD creds, mapping could only fail). Gate here as well as at the call
 # site - see the 579C144 note in the previous version.
@@ -53,6 +54,36 @@ if ($pcType -and ($selfContainedTypes -contains $pcType)) {
 # --- stage the script ----------------------------------------------------
 $src = Join-Path $PSScriptRoot 'lib\Map-SfldShare.ps1'
 if (-not (Test-Path $src)) { Write-RegLog "Map-SfldShare.ps1 not found at $src - cannot register"; exit 1 }
+$srcHash  = (Get-FileHash -Path $src -Algorithm SHA256).Hash
+$stampKey = 'HKLM:\SOFTWARE\GE\SfldShare'
+
+# Manifest / share drift guard. The GE-Enforce entry detects on
+# MapperHash == DetectionValue, so a share edit without a DetectionValue bump
+# makes the engine call this every cycle. Say so once per hash, and take the
+# fast path below so that loop costs nothing and never churns the task.
+if ($ExpectedHash -and ($ExpectedHash -ne $srcHash)) {
+    $warned = (Get-ItemProperty -Path $stampKey -Name DriftWarnedHash -EA SilentlyContinue).DriftWarnedHash
+    if ($warned -ne $srcHash) {
+        Write-RegLog "WARN: share Map-SfldShare.ps1 is $srcHash but the manifest DetectionValue is $ExpectedHash - bump DetectionValue in common/manifest.json or the engine re-runs this every cycle"
+        if (-not (Test-Path $stampKey)) { New-Item -Path $stampKey -Force | Out-Null }
+        Set-ItemProperty -Path $stampKey -Name DriftWarnedHash -Value $srcHash -Type String -EA SilentlyContinue
+    }
+}
+
+# Fast path: staged copy already matches the share and the task exists with
+# our action -> nothing to (re)do. Re-stamp and leave (no Register -Force,
+# so a live task is never torn down for no reason).
+$taskNow = Get-ScheduledTask -TaskName $taskName -EA SilentlyContinue
+if ($taskNow -and (Test-Path $mapScript) -and
+    ((Get-FileHash -Path $mapScript -Algorithm SHA256).Hash -eq $srcHash) -and
+    ($taskNow.Actions[0].Execute -like '*conhost.exe') -and
+    ($taskNow.Actions[0].Arguments -like "*$mapScript*")) {
+    if (-not (Test-Path $stampKey)) { New-Item -Path $stampKey -Force | Out-Null }
+    Set-ItemProperty -Path $stampKey -Name MapperHash -Value $srcHash -Type String -EA SilentlyContinue
+    exit 0
+}
+
+Write-RegLog '=== Register-MapSfldShare start ==='
 if (-not (Test-Path $InstallRoot)) { New-Item -Path $InstallRoot -ItemType Directory -Force | Out-Null }
 Copy-Item -Path $src -Destination $mapScript -Force
 Write-RegLog "Staged $src -> $mapScript"
@@ -69,9 +100,14 @@ if (Get-ScheduledTask -TaskName $legacyTask -EA SilentlyContinue) {
 
 # --- task ------------------------------------------------------------------
 try {
+    # conhost --headless, not powershell -WindowStyle Hidden: on Win11 the
+    # default console host is Windows Terminal, which ignores the hosted
+    # app's Hidden style and flashes a window + steals foreground for
+    # ~0.5 s on every fire (measured in the VM). Headless conhost shows
+    # nothing and moves focus nowhere.
     $ps = "$env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe"
-    $action = New-ScheduledTaskAction -Execute $ps `
-        -Argument ('-NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "{0}"' -f $mapScript)
+    $action = New-ScheduledTaskAction -Execute "$env:SystemRoot\System32\conhost.exe" `
+        -Argument ('--headless "{0}" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "{1}"' -f $ps, $mapScript)
 
     $ns = 'Root/Microsoft/Windows/TaskScheduler'
     $triggers = New-Object System.Collections.ArrayList