Keyence ongoing-update enforcer (tsgwp00525 share pattern)

Adds a CMM-style logon enforcer so VR-6000 updates push fleet-wide
without re-imaging.

- keyence-manifest.json: declares VR-6000 MSI (ProductCode-keyed) and
  KEYENCE VR USB driver (pnputil-keyed). Single source of truth for
  both imaging-time and ongoing-enforcement paths.
- lib/Install-FromManifest.ps1: forked from CMM/lib; adds DetectionMethod
  "pnputil" (regex-matches `pnputil /enum-drivers` output) and Type
  "INF" (invokes `pnputil /add-driver /install`). Everything else
  unchanged so CMM-style error parsing + MSI log scanning carry over.
- Keyence-Enforce.ps1: forked from CMM-Enforce.ps1. SYSTEM scheduled
  task, logon trigger, mounts tsgwp00525 SFLD share with creds from
  HKLM:\SOFTWARE\GE\SFLD\Credentials (provisioned by Azure DSC),
  hands off to Install-FromManifest against the share manifest.
- 09-Setup-Keyence.ps1: rewritten around the manifest. Runs
  Install-FromManifest at imaging time, stages runtime scripts to
  C:\Program Files\GE\Keyence, registers "GE Keyence Enforce"
  scheduled task. Idempotent.
- site-config.json: add keyenceSharePath to the Keyence profile
  pointing at \\tsgwp00525\shared\dt\shopfloor\keyence\machineapps.

To push a new VR-6000 version: drop the new MSI + updated manifest on
the tsgwp00525 share, every Keyence PC upgrades on next logon.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Keyence/keyence-manifest.json

@@ -0,0 +1,25 @@
+{
+  "Version": "1.0",
+  "_comment": "Keyence machine-app manifest. Consumed by both 09-Setup-Keyence.ps1 (at imaging time, reading from the in-repo shopfloor-setup/Keyence/ dir xcopied by startnet.cmd) and Keyence-Enforce.ps1 (on logon, reading from the tsgwp00525 share). Each entry has an InstallerRoot-relative 'Installer' path plus standard detection. The 'Type' field is MSI, EXE, or INF: INF invokes pnputil /add-driver /install. When releasing a new VR-6000 version, update the Installer path + DetectionValue here, drop the new MSI on the tsgwp00525 share, and every Keyence PC picks it up on next logon.",
+  "Applications": [
+    {
+      "_comment": "VR-6000 Series Software - main Keyence microscope/profilometer control app. Extracted from Keyence6000.exe (Inno Setup wrapper around an InstallShield 2019 MSI). Silent install works fine with /qn + REBOOT=ReallySuppress as long as you bypass the Inno wrapper - the wrapper's [Run] entry calls the bundled InstallShield Setup.exe without silent flags which hangs in session 0.",
+      "Name": "VR-6000 Series Software",
+      "Installer": "installers\\VR-6000 Series Software.msi",
+      "Type": "MSI",
+      "InstallArgs": "/qn /norestart ALLUSERS=1 REBOOT=ReallySuppress",
+      "DetectionMethod": "Registry",
+      "DetectionPath": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{058E7194-BDF8-4FA2-9D69-978BB0F25214}",
+      "DetectionName": "DisplayVersion",
+      "DetectionValue": "4.3.7"
+    },
+    {
+      "_comment": "KEYENCE VR Series USB driver (WinUSB-based). Pulled from DriverStore after a full interactive install because dpinst.exe in the Inno wrapper needs GUI confirmation. pnputil /add-driver /install stages the INF + cat + co-installer DLLs to the Windows DriverStore; if a physical VR device is plugged in, Windows binds it immediately. Detection checks 'pnputil /enum-drivers' output for the INF filename - this matches regardless of driver version so updates (new INF with same basename) won't false-skip.",
+      "Name": "KEYENCE VR Series USB Driver",
+      "Installer": "drivers\\keyence_vr_series.inf",
+      "Type": "INF",
+      "DetectionMethod": "pnputil",
+      "DetectionPattern": "keyence_vr_series\\.inf"
+    }
+  ]
+}