Collector: record whether each startup item is enabled or disabled

Disabling a startup item through Task Manager or Settings does not remove the Run
key or the Startup shortcut - Windows writes a flag into StartupApproved instead.
So the collector would have listed those entries as present with no indication
they had been switched off, and a bay where someone had already tidied up would
look identical to one where nothing autostarts.

Reads all five StartupApproved keys, including Run32 for the WOW64 view, and
decodes the first byte: 02/06 enabled, 03/07 disabled.

This matters for the current investigation because turning an item off is a
per-machine workaround - the next imaged bay installs and starts it again. The
fix is not installing it, which needs the app-to-autostart mapping this section
preserves.

playbook/shopfloor-setup/Collect-ImagingDiagnostics.ps1

@@ -165,6 +165,31 @@ Section 'autostart.txt' {
         if (Test-Path $d) { "--- $d ---"; Get-ChildItem $d | Select-Object Name | Format-Table -AutoSize }
     }
     ''
+    '== enabled/disabled state (StartupApproved) =='
+    # Disabling a startup item via Task Manager or Settings does NOT remove the
+    # Run key or the Startup shortcut - it writes a flag here. So an entry can
+    # appear above and still be switched off. First byte 02/06 = enabled,
+    # 03/07 = disabled. Capturing this is what tells "imaging installed it and
+    # it runs" apart from "imaging installed it and somebody turned it off",
+    # which matters because the fix is not to install it at all.
+    foreach ($k in 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run',
+                   'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder',
+                   'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run',
+                   'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32',
+                   'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder') {
+        if (Test-Path $k) {
+            "--- $k ---"
+            $props = Get-Item $k
+            foreach ($n in $props.Property) {
+                $v = (Get-ItemProperty $k -Name $n).$n
+                $state = if ($v -is [byte[]] -and $v.Length -ge 1) {
+                    switch ($v[0]) { 2 {'ENABLED'} 6 {'ENABLED'} 3 {'disabled'} 7 {'disabled'} default {"unknown(0x{0:X2})" -f $v[0]} }
+                } else { 'unknown' }
+                "{0,-10} {1}" -f $state, $n
+            }
+        }
+    }
+    ''
     '== scheduled tasks (non-Microsoft) =='
     Get-ScheduledTask -EA SilentlyContinue |
         Where-Object { $_.TaskPath -notlike '\Microsoft\*' } |