Shell defaults + eDNC reg restore from machine-number backups

- 03-ShellDefaults.ps1: Default-User TaskbarAl=0 (left), HKLM policies to
  hide Start Recommended section, kill Bing web search + suggestions,
  disable Cortana. LTSC-honoured; runs fleet-wide via baseline loop.

- ntlars-backups/: 147 per-machine eDNC registry backups renamed to
  flat <MachineNumber>.reg scheme. Historical off-by-one entries from
  the original dump rewritten to match CSV-target MachineNo.

- Standard/03-RestoreEDncConfig.ps1: at imaging time, if tech typed a
  real machine number at PXE (not 9999), import <num>.reg from the local
  staged copy. Restores eFocas IP, PPDCS serial, Hssb relays -- not just
  the bare MachineNo. Skipped on Timeclock / 9999 / missing backup.

- Update-MachineNumber.ps1: when tech later sets a real number from 9999,
  pull <num>.reg from tsgwp00525 SFLD share (ntlarsBackupSharePath in
  site-config) and reg-import it before writing the new MachineNo.

- Restore-EDncReg.ps1: shared helper (Mount-SFLDShare + Import-EDncRegBackup)
  used by both callers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/lib/Update-MachineNumber.ps1

@@ -60,7 +60,43 @@ function Update-MachineNumber {
         [string]$Site = 'West Jefferson'
     )
 
-    $out = @{ UdcUpdated = $false; EdncUpdated = $false; Errors = @() }
+    $out = @{ UdcUpdated = $false; EdncUpdated = $false; Errors = @(); RegImported = $null }
+
+    # --- If UDC or eDNC is still at placeholder 9999, try to pull the
+    #     per-machine .reg backup from the SFLD share and restore all
+    #     the eFocas/PPDCS/Hssb config. The tech-typed $NewNumber is still
+    #     written last (below), so the restore never clobbers it. ---
+    $current = Get-CurrentMachineNumber
+    $isPlaceholder = (($current.Udc -in @('9999', $null, '')) -or ($current.Ednc -in @('9999', $null, '')))
+
+    if ($isPlaceholder -and $NewNumber -ne '9999') {
+        $sharePath = $null
+        $siteCfgPath = 'C:\Enrollment\site-config.json'
+        if (Test-Path $siteCfgPath) {
+            try {
+                $cfg = Get-Content $siteCfgPath -Raw | ConvertFrom-Json
+                $sharePath = $cfg.pcProfiles.'Standard-Machine'.ntlarsBackupSharePath
+            } catch {}
+        }
+
+        if ($sharePath) {
+            try {
+                . (Join-Path $PSScriptRoot 'Restore-EDncReg.ps1')
+                $mounted = Mount-SFLDShare -SharePath $sharePath -DriveLetter 'V:'
+                if ($mounted) {
+                    try {
+                        $out.RegImported = Import-EDncRegBackup -SourceRoot 'V:\' -MachineNumber $NewNumber
+                    } finally {
+                        & net use V: /delete /y 2>$null | Out-Null
+                    }
+                } else {
+                    Write-Host "  Update-MachineNumber: SFLD share unreachable - skipping restore."
+                }
+            } catch {
+                $out.Errors += "ntlars restore failed: $_"
+            }
+        }
+    }
 
     # --- Stop UDC before editing its JSON (avoid stale shutdown write) ---
     Get-Process UDC -ErrorAction SilentlyContinue | ForEach-Object {