Shopfloor images: add Wax/Trace + Keyence per-model variants

Wax/Trace (gea-shopfloor-waxtrace):
- captured/ holds master FormTracePak v6.0 state (Program Files reg dump
  gzipped, ARP entries) taken from a win11 VM where the CD-ROM-bound VB6
  wrapper was driven to completion. xcopy + reg-import replays the install
  on real bays without running the wrapper itself.
- 09-Setup-WaxAndTrace.ps1 rewrites the stub: installs prereqs via manifest
  (VC++ 2008/2017 x86+x64, Sentinel HASP), expands the captured zips into
  C:\Program Files (x86)\MitutoyoApp + C:\MitutoyoApp, imports the reg
  hive, then mounts the bay's per-machine cal ISO (matched by asset tag
  in machine-number.txt) and runs its Setup.exe.
- waxtrace-manifest.json lists the 5 prereqs with InstallShield-style
  silent flags verified on the win11 VM.
- sync-waxtrace.sh ships captured-binary/ + prereqs + cal ISOs from
  /home/camp/pxe-images/iso/mitutoyo-cal/ to
  /srv/samba/enrollment/installers-post/waxtrace/ on the PXE box.
- select-waxtrace-asset.ps1 arrow-key bay picker for WinPE (parses
  INDEX.csv from the cal share, offers "Other (new bay)" fallback).
- startnet.cmd: prompt_waxtrace_asset prompt, skip_waxtrace_stage xcopy
  block (mirrors :skip_cmm_stage), machine-number.txt write covers bay
  asset tag (WJRP*).

Keyence (gea-shopfloor-keyence) - now multi-model:
- vr3000/manifest.json + vr5000/manifest.json + vr6000/manifest.json
  (current single-model VR-6000 moved into vr6000/ subdir). Each ships
  the model's MSI silent-install + DetectionPath via ProductCode.
  Big payloads (Data1.cab, Data11.cab) gitignored, staged via
  sync-keyence.sh from /home/camp/pxe-images/iso/keyence/.
- 09-Setup-Keyence.ps1 dispatches by C:\Enrollment\keyence-model.txt
  (written by startnet.cmd in :keyence_submenu) and points
  InstallerRoot at C:\KeyenceInstall\<model>. DXSETUP probe widened
  to all three Program Files paths (VR-3000 G2, VR-5000, VR-6000).
- startnet.cmd: :keyence_submenu picks vr3000/vr5000/vr6000,
  :skip_keyence_stage xcopy block selectively stages chosen model bundle,
  pc-subtype.txt also written = drops directly into existing GE-Enforce
  PCSubType wiring (looks for gea-shopfloor-keyence-<model>\manifest.json
  on the tsgwp00525 share for ongoing enforcement, no dispatcher change
  needed).
- sync-keyence.sh mirrors sync-waxtrace.sh pattern.

Verified silent MSI install for VR-3000 G2 v2.5.0 and VR-5000 v3.3.1 on
the win11 VM 2026-05-18 with /qn /norestart ALLUSERS=1 REBOOT=ReallySuppress
TRANSFORMS=1033.mst. boot.wim on 172.16.9.1 wimupdate'd with the new
startnet.cmd.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/sync-keyence.sh

@@ -0,0 +1,86 @@
+#!/bin/bash
+# sync-keyence.sh - Push Keyence per-model bootstrap bundles to the PXE share.
+#
+# Mirrors sync-waxtrace.sh / sync-cmm.sh pattern. For each Keyence model
+# (vr3000, vr5000, vr6000) ships the manifest + installer payload (MSI + cabs
+# + drivers) from the local workstation to
+# /srv/samba/enrollment/installers-post/keyence/<model>/ on the PXE server.
+#
+# This becomes visible as \\172.16.9.1\enrollment\installers-post\keyence\<model>
+# so startnet.cmd can selectively xcopy the chosen model bundle onto the
+# target disk during WinPE phase (W:\KeyenceInstall, becomes C:\KeyenceInstall
+# post-reboot).
+#
+# Run on the workstation any time:
+#   - A per-model manifest changes
+#   - Big installer payloads (Data1.cab, etc) change
+#
+# Big payloads (Data1.cab, Data11.cab, MSIs) live in the repo under
+# playbook/shopfloor-setup/gea-shopfloor-keyence/<model>/installers/ but
+# are gitignored. Stage them locally from the ripped ISOs in
+# /home/camp/pxe-images/iso/keyence/ before running this script.
+#
+# Requires: sshpass, scp, ssh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+PXE_HOST="${PXE_HOST:-172.16.9.1}"
+PXE_USER="${PXE_USER:-pxe}"
+PXE_PASS="${PXE_PASS:-pxe}"
+
+KEYENCE_DIR="$PROJECT_ROOT/playbook/shopfloor-setup/gea-shopfloor-keyence"
+REMOTE_DIR="/srv/samba/enrollment/installers-post/keyence"
+REMOTE_TEMP="/tmp/keyence-stage-$$"
+
+ssh_run() {
+    sshpass -p "$PXE_PASS" ssh -o StrictHostKeyChecking=no -o LogLevel=ERROR "$PXE_USER@$PXE_HOST" "$@"
+}
+
+scp_to() {
+    sshpass -p "$PXE_PASS" scp -o StrictHostKeyChecking=no -o LogLevel=ERROR "$@"
+}
+
+# Sanity
+for f in 09-Setup-Keyence.ps1 vr3000/manifest.json vr5000/manifest.json vr6000/manifest.json; do
+    test -f "$KEYENCE_DIR/$f" || { echo "Missing $KEYENCE_DIR/$f"; exit 1; }
+done
+
+echo "==> Staging tree locally"
+STAGE="$(mktemp -d -p /tmp keyence-stage.XXXXXX)"
+trap "rm -rf $STAGE" EXIT
+
+for model in vr3000 vr5000 vr6000; do
+    mkdir -p "$STAGE/$model/installers"
+    cp "$KEYENCE_DIR/$model/manifest.json" "$STAGE/$model/"
+    if [ -d "$KEYENCE_DIR/$model/installers" ]; then
+        cp -a "$KEYENCE_DIR/$model/installers/." "$STAGE/$model/installers/" 2>/dev/null || true
+    fi
+    if [ -d "$KEYENCE_DIR/$model/drivers" ]; then
+        mkdir -p "$STAGE/$model/drivers"
+        cp -a "$KEYENCE_DIR/$model/drivers/." "$STAGE/$model/drivers/"
+    fi
+    sz=$(du -sh "$STAGE/$model" | cut -f1)
+    echo "  $model: $sz"
+done
+
+echo "==> Local stage size: $(du -sh $STAGE | cut -f1)"
+
+echo "==> Pushing to $PXE_USER@$PXE_HOST:$REMOTE_TEMP"
+ssh_run "rm -rf '$REMOTE_TEMP' && mkdir -p '$REMOTE_TEMP'"
+scp_to -r "$STAGE/." "$PXE_USER@$PXE_HOST:$REMOTE_TEMP/"
+
+echo "==> Atomic move into $REMOTE_DIR"
+ssh_run "echo $PXE_PASS | sudo -S bash -c '
+  mkdir -p $(dirname $REMOTE_DIR)
+  if [ -d $REMOTE_DIR ]; then
+    mv $REMOTE_DIR ${REMOTE_DIR}.pre-\$(date +%Y%m%d-%H%M%S)
+  fi
+  mv $REMOTE_TEMP $REMOTE_DIR
+  chown -R pxe:pxe $REMOTE_DIR
+  ls -la $REMOTE_DIR
+'"
+
+echo "==> Done. Next imaged Keyence PC picks up the new bundles."