Bring the share's common scripts under version control

Sixteen files that run on every shopfloor PC existed only on the SFLD share.
The cost showed up while debugging the NTLARS backup: the script that posts to
ShopDB could not be read, reviewed or diffed, so its behaviour was inferred
from log output for most of a day. It turned out to hold a silent fallback that
had been governing the whole fleet for months.

Imported as-is from tsgwp00525-v2, no edits:

  lib/ShopdbBackupClient.psm1        the shared backup client
  scripts/Backup-NtlarsSettings.ps1  converted to use it
  scripts/Set-ShopdbCollectorKey.ps1 collector credential delivery
  scripts/Test-RegExport.ps1         exercises the .reg codec with mocks
  scripts/Set-EventSaver*.ps1        kiosk power / screensaver / disable
  scripts/Setup-OpenText.*           OpenText install + toolbar
  scripts/Migrate-PCType.ps1, Select-KioskType.ps1, Set-FmsHostsEntry.ps1,
  scripts/ensure-vnc-firewall.ps1, Install-AcroReader.cmd, Install-Oracle11r2.cmd

lib/Install-FromManifest.ps1 is also updated from the share, which was 37 lines
AHEAD of this repo and purely additive: the Add-EnforceResult reporting added
during the kiosk API cutover, done live and never committed back. Nothing was
removed.

Checked for embedded secrets before committing; there are none.
Set-ShopdbCollectorKey deliberately reads its token from a sibling file on the
share rather than holding it, so the script is safe to track.

The share remains what actually runs. This makes it reviewable, and makes the
next drift visible as a diff rather than a surprise.

playbook/shopfloor-setup/common/lib/Install-FromManifest.ps1

@@ -643,6 +643,18 @@ $skipped   = 0
 $failed    = 0
 $pcFiltered = 0
 
+# Per-entry outcomes for the caller's report (the API enforce runner captures
+# the object emitted at the end). SMB/GE-Enforce.ps1 ignores stdout + reads the
+# exit code, so this is additive and does not change the share path.
+$script:enforceResults = [System.Collections.Generic.List[object]]::new()
+function Add-EnforceResult {
+    param([string]$Name, [string]$Action, [int]$ExitCode = 0,
+          [bool]$SelfHealed = $false, [string]$Message = '')
+    $script:enforceResults.Add([pscustomobject]@{
+        Name = $Name; Action = $Action; ExitCode = $ExitCode
+        SelfHealed = $SelfHealed; Message = $Message })
+}
+
 foreach ($app in $config.Applications) {
     # Cancel any reboot that a prior MSI queued, so the enforcer never
     # triggers an unexpected restart on a shopfloor PC.
@@ -658,12 +670,14 @@ foreach ($app in $config.Applications) {
     if (-not (Test-PCTypeMatches -App $app -Type $PCType -SubType $PCSubType)) {
         Write-InstallLog "  PCTypes filter: entry targets $($app.PCTypes -join ',') but PC is $PCType$(if ($PCSubType) { "-$PCSubType" }) - skipping"
         $pcFiltered++
+        Add-EnforceResult -Name $app.Name -Action 'filtered' -Message 'PCTypes filter'
         continue
     }
 
     if (-not (Test-HostnameMatches -App $app)) {
         Write-InstallLog "  TargetHostnames filter: entry targets $($app.TargetHostnames -join ',') but PC is $([System.Environment]::MachineName) - skipping"
         $pcFiltered++
+        Add-EnforceResult -Name $app.Name -Action 'filtered' -Message 'TargetHostnames filter'
         continue
     }
 
@@ -671,6 +685,7 @@ foreach ($app in $config.Applications) {
         $myNum = Get-CurrentMachineNumber
         Write-InstallLog "  TargetMachineNumbers filter: entry targets $($app.TargetMachineNumbers -join ',') but machine number is $(if ($myNum) { $myNum } else { '(none)' }) - skipping"
         $pcFiltered++
+        Add-EnforceResult -Name $app.Name -Action 'filtered' -Message 'TargetMachineNumbers filter'
         continue
     }
 
@@ -678,12 +693,14 @@ foreach ($app in $config.Applications) {
         $myVer = Get-CurrentCmmVersion
         Write-InstallLog "  _CmmVersion filter: entry targets $($app._CmmVersion) but bay version is $(if ($myVer) { $myVer } else { '(none)' }) - skipping"
         $pcFiltered++
+        Add-EnforceResult -Name $app.Name -Action 'filtered' -Message '_CmmVersion filter'
         continue
     }
 
     if (Test-AppInstalled -App $app) {
         Write-InstallLog '  Already installed at expected version - skipping'
         $skipped++
+        Add-EnforceResult -Name $app.Name -Action 'skipped' -Message 'already installed'
         continue
     }
 
@@ -723,6 +740,12 @@ foreach ($app in $config.Applications) {
         if ($rc -eq 1641) { Write-InstallLog "  (Installer initiated a reboot for $($app.Name))" }
         if ($rc -eq 259)  { Write-InstallLog '  (pnputil: no newer driver found - considered installed)' }
         $installed++
+        # SelfHealed = a real drift correction (a detected-missing entry we
+        # re-installed). Always/no-detection entries install every cycle by
+        # design and are not self-heals, so the report stays 'ok' for them.
+        Add-EnforceResult -Name $app.Name -Action 'installed' -ExitCode $rc `
+            -SelfHealed ([bool]($app.DetectionMethod -and $app.DetectionMethod -ne 'Always')) `
+            -Message "Exit $rc"
 
         # Auto-write marker file for MarkerFile-detected entries that just
         # completed successfully. Keeps one-shot PS1 scripts from running
@@ -767,11 +790,13 @@ foreach ($app in $config.Applications) {
         }
 
         $failed++
+        Add-EnforceResult -Name $app.Name -Action 'failed' -ExitCode $rc -Message "Exit $rc - FAILED"
     }
 
     } catch {
         Write-InstallLog ("  UNCAUGHT error processing {0}: {1} | at {2}" -f $app.Name, $_.Exception.Message, ($_.ScriptStackTrace -replace '\s+',' ')) 'ERROR'
         $failed++
+        Add-EnforceResult -Name $app.Name -Action 'failed' -Message $_.Exception.Message
     }
 }
 
@@ -781,5 +806,17 @@ Write-InstallLog '============================================'
 
 cmd /c 'shutdown /a 2>nul' *>$null
 
+# Emit the summary object for the API enforce runner to report. Write-Host log
+# lines above go to the host stream, so this is the only value on the success
+# stream that '& $EnginePath' captures. The exit code is unchanged (SMB path).
+Write-Output ([pscustomobject]@{
+    Installed       = $installed
+    Skipped         = $skipped
+    Failed          = $failed
+    Filtered        = $pcFiltered
+    EnforcerVersion = "$LIB_MANIFEST_MAJOR.$LIB_MANIFEST_MINOR"
+    Results         = $script:enforceResults.ToArray()
+})
+
 if ($failed -gt 0) { exit 1 }
 exit 0