Monitor: strip ANSI escape codes from dsregcmd output before regex

Smoking gun for "Monitor's on-screen QR works but no idx=7 push lands
on the PXE dashboard". Win11's dsregcmd emits ANSI VT100 escape codes
(e.g. \x1B[7mDeviceId\x1B[0m :) around field labels. Captured output
strings then have those codes between "DeviceId" and ":". The strict
regex 'DeviceId\s*:\s*<guid>' fails because \s* doesn't match ANSI
escape chars. $script:cache.DeviceId stays null, idx=7 push never
fires.

Build-QRCodeText was unaffected because it uses Select-String 'DeviceId'
(substring match, tolerates anything in between) then splits on ':'.

Fix: strip ANSI sequences via -replace '\x1B\[[0-9;]*[A-Za-z]', '' before
running the regex. Same pattern covers all CSI sequences dsregcmd uses.
Also force Out-String to get a single string back (was an array of lines
from 2>&1; -match on arrays returns matching elements but $matches
behavior across mixed objects is fragile).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1

@@ -213,7 +213,12 @@ function Get-Phase1 {
     # on-screen QR works but the dashboard QR did not.
     if (-not $script:cache.AzureAdJoined -or -not $script:cache.DeviceId) {
         try {
-            $dsreg = dsregcmd /status 2>&1
+            # dsregcmd on Win11 emits ANSI escape codes (\x1B[7m...\x1B[0m)
+            # around field names when its output is treated as a terminal.
+            # Captured output then contains those codes between e.g.
+            # "DeviceId" and ":", breaking a tight regex like
+            # 'DeviceId\s*:\s*<value>'. Strip ANSI sequences before matching.
+            $dsreg = (dsregcmd /status 2>&1 | Out-String) -replace '\x1B\[[0-9;]*[A-Za-z]', ''
             if (-not $script:cache.AzureAdJoined -and $dsreg -match 'AzureAdJoined\s*:\s*YES') {
                 $script:cache.AzureAdJoined = $true
             }