Bring the share's common scripts under version control

Sixteen files that run on every shopfloor PC existed only on the SFLD share.
The cost showed up while debugging the NTLARS backup: the script that posts to
ShopDB could not be read, reviewed or diffed, so its behaviour was inferred
from log output for most of a day. It turned out to hold a silent fallback that
had been governing the whole fleet for months.

Imported as-is from tsgwp00525-v2, no edits:

  lib/ShopdbBackupClient.psm1        the shared backup client
  scripts/Backup-NtlarsSettings.ps1  converted to use it
  scripts/Set-ShopdbCollectorKey.ps1 collector credential delivery
  scripts/Test-RegExport.ps1         exercises the .reg codec with mocks
  scripts/Set-EventSaver*.ps1        kiosk power / screensaver / disable
  scripts/Setup-OpenText.*           OpenText install + toolbar
  scripts/Migrate-PCType.ps1, Select-KioskType.ps1, Set-FmsHostsEntry.ps1,
  scripts/ensure-vnc-firewall.ps1, Install-AcroReader.cmd, Install-Oracle11r2.cmd

lib/Install-FromManifest.ps1 is also updated from the share, which was 37 lines
AHEAD of this repo and purely additive: the Add-EnforceResult reporting added
during the kiosk API cutover, done live and never committed back. Nothing was
removed.

Checked for embedded secrets before committing; there are none.
Set-ShopdbCollectorKey deliberately reads its token from a sibling file on the
share rather than holding it, so the script is safe to track.

The share remains what actually runs. This makes it reviewable, and makes the
next drift visible as a diff rather than a surprise.

playbook/shopfloor-setup/common/scripts/Set-OpenTextToolbar.ps1

@@ -0,0 +1,58 @@
+# Set-OpenTextToolbar.ps1 - replace the HostExplorer default VT toolbar.
+#
+# Copies the toolbar shipped in this share over the local one at:
+#   C:\ProgramData\Hummingbird\Connectivity\15.00\Shared\HostExplorer\Toolbar\
+#
+# Runs from the common manifest with DetectionMethod Always, so it also
+# self-heals if the file is changed locally.
+#
+# Deliberately does NOT bump the OpenText version. Setup-OpenText.ps1 skips
+# unless HKLM:\SOFTWARE\GE\OpenText\Installed differs from version.txt, so a
+# bump re-runs the whole thing - MSI plus the SP1 patch - on every OpenText
+# machine over SMB, to ship a 565-byte file. This entry copies just the file.
+
+$ErrorActionPreference = 'Continue'
+
+$fileName = 'Default VT Toolbar.tbv'
+$src      = Join-Path $PSScriptRoot "..\apps\opentext\HostExplorer\Toolbar\$fileName"
+$dstDir   = 'C:\ProgramData\Hummingbird\Connectivity\15.00\Shared\HostExplorer\Toolbar'
+$dst      = Join-Path $dstDir $fileName
+
+Write-Host '=== OpenText VT toolbar ==='
+
+if (-not (Test-Path -LiteralPath $src)) {
+    Write-Host "  source missing on share: $src - nothing to do."
+    return
+}
+
+# Gate on OpenText actually being installed. The Shared root only exists once
+# HostExplorer content has been deployed, so its absence means this machine has
+# no OpenText and we should not create a stray Hummingbird tree.
+$sharedRoot = 'C:\ProgramData\Hummingbird\Connectivity\15.00\Shared'
+if (-not (Test-Path -LiteralPath $sharedRoot)) {
+    Write-Host '  OpenText not installed on this PC - skipping.'
+    return
+}
+
+# Skip when identical, so an Always entry is not rewriting the file every cycle.
+if (Test-Path -LiteralPath $dst) {
+    $sh = (Get-FileHash -LiteralPath $src -Algorithm SHA256).Hash
+    $dh = (Get-FileHash -LiteralPath $dst -Algorithm SHA256).Hash
+    if ($sh -eq $dh) {
+        Write-Host '  already current - no change.'
+        return
+    }
+    Write-Host '  local copy differs - replacing.'
+} else {
+    Write-Host '  not present locally - installing.'
+}
+
+try {
+    if (-not (Test-Path -LiteralPath $dstDir)) {
+        New-Item -ItemType Directory -Path $dstDir -Force -ErrorAction Stop | Out-Null
+    }
+    Copy-Item -LiteralPath $src -Destination $dst -Force -ErrorAction Stop
+    Write-Host "  replaced $dst"
+} catch {
+    Write-Warning "  failed to replace ${dst}: $_"
+}