Monitor + imaging: per-phase sub-stages within idx=7

Monitor's Get-Snapshot already tracks Phase 1-5 (Intune Registration,
Device Configuration, Software Deployment, Credentials, Lockdown).
The webapp dashboard only saw a single idx=7 push for the entire
post-PPKG / pre-lockdown window, so the friendly label couldn't
reflect "where is this bay actually". Operator looking at the
dashboard had no idea whether to assign category or hit ARTS for
lockdown next.

Monitor now pushes additional idx=7 entries as it crosses Phase
boundaries:
 - On DeviceId capture: "Intune Device ID captured" (existing)
 - On Phase 2 done (SFLD policy delivered = category was assigned):
   "Phase 2 SFLD policy delivered (device configuration)"
 - On Phase 1-4 all complete: "Phases 1-4 complete - ready for
   lockdown (ARTS request)"
 - On lockdown done: idx=8 (existing)

imaging.html maps the stage_string substring to friendly labels:
 - default idx=7         -> "Registered - assign category"
 - 'sfld policy' / 'phase 2' -> "Phase 2 - device configuration"
 - 'credentials' / 'phase 4' -> "Phase 3 / 4 - DSC + credentials"
 - 'ready for lockdown' / 'request lockdown' -> "Ready - request
                              lockdown" (hint: click ARTS request)

Operator now knows exactly when to act vs when to wait.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1

@@ -186,6 +186,8 @@ $script:cache = @{
     EnrollmentId             = $null
     DeviceId                 = $null
     DeviceIdReported         = $false
+    SfldPolicyPushed         = $false
+    CredsReadyPushed         = $false
     LockdownCompletePushed   = $false
     InternetAccessDeleted    = $false
 }
@@ -1240,6 +1242,35 @@ try {
     while ($true) {
         $snap = Get-Snapshot
 
+        # Push sub-stage transitions to PXE dashboard so the operator sees
+        # whether the bay is waiting on category assignment, or has
+        # progressed past it. idx stays 7 across all three; the stage
+        # string drives the friendly label in imaging.html.
+        if (-not $script:cache.SfldPolicyPushed -and
+            $snap.Phase2.SfldRoot -and $snap.Phase2.FunctionOk -and $snap.Phase2.SasTokenOk) {
+            if (Get-Command Send-PxeStatus -ErrorAction SilentlyContinue) {
+                try {
+                    Send-PxeStatus -Stage 'Monitor-IntuneProgress: Phase 2 SFLD policy delivered (device configuration)' `
+                                   -StageIndex 7 -StageTotal 8 `
+                                   -IntuneDeviceId $script:cache.DeviceId -ErrorAction SilentlyContinue
+                    $script:cache.SfldPolicyPushed = $true
+                } catch {}
+            }
+        }
+        if (-not $script:cache.CredsReadyPushed -and
+            $snap.Phase4.CredsPopulated -and
+            $snap.Phase3.InstallComplete -and
+            $snap.Phase2.SfldRoot -and $snap.Phase2.FunctionOk -and $snap.Phase2.SasTokenOk) {
+            if (Get-Command Send-PxeStatus -ErrorAction SilentlyContinue) {
+                try {
+                    Send-PxeStatus -Stage 'Monitor-IntuneProgress: Phases 1-4 complete - ready for lockdown (ARTS request)' `
+                                   -StageIndex 7 -StageTotal 8 `
+                                   -IntuneDeviceId $script:cache.DeviceId -ErrorAction SilentlyContinue
+                    $script:cache.CredsReadyPushed = $true
+                } catch {}
+            }
+        }
+
         # Retry QR code every cycle until it actually renders. dsregcmd
         # may report AzureAdJoined=YES before DeviceId is populated, so
         # a single-shot refresh misses the window.