Phase 3+4 rename reorg: repo dir renames + startnet.cmd menu

Pairs with Phase 1+2 from earlier (alias maps in Install-FromManifest,
GE-Enforce, Get-PCProfile, verify-state). See project-shopfloor-rename-reorg
memory for the plan.

Phase 3 (repo + paths):
- git mv per-PC-type dirs to gea-shopfloor-* names:
    Standard      -> gea-shopfloor-collections
    CMM           -> gea-shopfloor-cmm
    Keyence       -> gea-shopfloor-keyence
    Genspect      -> gea-shopfloor-genspect
    WaxAndTrace   -> gea-shopfloor-waxtrace
    Display       -> gea-shopfloor-display
    Lab           -> gea-shopfloor-common (folded; Timeclock+Lab merge)
- New gea-shopfloor-nocollections/ (clone of collections sans UDC scripts).
- New gea-shopfloor-heattreat/ (placeholder, README only).
- Move Standard/ntlars-backups/ -> _ntlars-backups/ (per-MN, not per-type).
- Run-ShopfloorSetup.ps1: Resolve-PCTypeDir helper walks alias group when
  the on-disk dir for the current pcType is missing. Set-MachineNumber
  helper-copy gated on collections|nocollections|legacy Standard-Machine.
- Update-MachineNumber.ps1: pcProfiles lookups try gea-shopfloor-collections
  first, fall back to legacy Standard-Machine. PowerShell 5.1 compatible
  (no null-coalesce).

Phase 4 (startnet.cmd menu):
- Choice 3 "GEA Shopfloor" now drills into a 9-item sub-menu instead of
  going straight to enrollment. Sub-cats:
    1. Machine with Collections        -> gea-shopfloor-collections
    2. Machine without Collections     -> gea-shopfloor-nocollections
    3. Common (Timeclock, Lab)         -> gea-shopfloor-common
    4. Keyence                         -> gea-shopfloor-keyence
    5. CMM                             -> gea-shopfloor-cmm
    6. Genspect                        -> gea-shopfloor-genspect
    7. Heattreat                       -> gea-shopfloor-heattreat
    8. Wax and Trace                   -> gea-shopfloor-waxtrace
    9. Display                         -> gea-shopfloor-display
- Office menu (existing 6-option) follows for every sub-cat.
- Machine number prompt only for collections + nocollections.
- pc-subtype.txt + display-type.txt no longer written. PCTYPE is a
  single full string (gea-shopfloor-*); subtype-aware code paths fall
  back to empty and resolve via the alias map.
- CMM bootstrap stage gate switched from "%PCTYPE%"=="CMM" to
  "%PCTYPE%"=="gea-shopfloor-cmm".

Test harness:
- B-enforce/run.sh PCSUBTYPE default changed from "Machine" to "" so
  single-arg invocation matches the new single-string scheme. Two-arg
  legacy form ("Standard Machine") still works via aliasing.
- B-enforce/tamper.ps1 alias-aware Test-MatrixEntryMatches mirroring
  verify-state.ps1.

Smoke-tested on win11 VM as SYSTEM via qga: B-enforce harness 5-phase
cycle (stage / baseline / tamper / heal / idempotent) passes 10/10
with PCType=gea-shopfloor-collections AND with legacy "Standard Machine"
two-arg form.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-nocollections/02-MachineNumberACLs.ps1

@@ -0,0 +1,81 @@
+# 02-MachineNumberACLs.ps1 - Pre-grant write access on the UDC settings
+# file and eDNC registry key so that STANDARD (non-admin) users can update
+# the machine number via the Check-MachineNumber logon task without
+# elevation or a UAC prompt.
+#
+# Runs during imaging as admin (type-specific Standard phase, after
+# 01-eDNC.ps1 has installed DnC). Only touches Standard PCs.
+#
+# What gets opened up (narrow scope, not blanket admin):
+#   - C:\ProgramData\UDC\udc_settings.json  ->  BUILTIN\Users : Modify
+#   - HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General
+#                                            ->  BUILTIN\Users : SetValue
+
+# --- Transcript ---
+$logDir = 'C:\Logs\SFLD'
+if (-not (Test-Path $logDir)) { try { New-Item -ItemType Directory -Path $logDir -Force | Out-Null } catch {} }
+try { Start-Transcript -Path (Join-Path $logDir '02-MachineNumberACLs.log') -Append -Force | Out-Null } catch {}
+
+# --- Skip on Timeclock sub-type (no UDC/eDNC to grant ACLs for) ---
+$subtypeFile = 'C:\Enrollment\pc-subtype.txt'
+if (Test-Path $subtypeFile) {
+    $subtype = (Get-Content $subtypeFile -First 1 -ErrorAction SilentlyContinue).Trim()
+    if ($subtype -eq 'Timeclock') {
+        Write-Host "02-MachineNumberACLs: skipped (Standard-Timeclock)"
+        try { Stop-Transcript | Out-Null } catch {}
+        return
+    }
+}
+
+Write-Host "02-MachineNumberACLs.ps1 starting $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
+Write-Host "Running as: $([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)"
+Write-Host ""
+Write-Host "Setting ACLs for standard-user machine number access..."
+
+# --- UDC settings directory ---
+# Set ACL on the DIRECTORY (not the file) with inheritance so that
+# udc_settings.json inherits the permission whenever UDC.exe creates it.
+# UDC_Setup.exe is killed by KillAfterDetection before UDC.exe writes the
+# JSON, so the file doesn't exist at this point. Directory-level ACL with
+# ContainerInherit + ObjectInherit covers any file created inside later.
+$udcDir = 'C:\ProgramData\UDC'
+if (Test-Path -LiteralPath $udcDir) {
+    try {
+        $acl = Get-Acl -LiteralPath $udcDir
+        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+            'BUILTIN\Users', 'Modify',
+            ([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
+             [System.Security.AccessControl.InheritanceFlags]::ObjectInherit),
+            [System.Security.AccessControl.PropagationFlags]::None,
+            'Allow')
+        $acl.AddAccessRule($rule)
+        Set-Acl -LiteralPath $udcDir -AclObject $acl -ErrorAction Stop
+        Write-Host "  UDC dir: BUILTIN\Users granted Modify (inherited) on $udcDir"
+    } catch {
+        Write-Warning "  Failed to set ACL on $udcDir : $_"
+    }
+} else {
+    Write-Host "  UDC dir not found at $udcDir - skipping (UDC not installed?)" -ForegroundColor DarkGray
+}
+
+# --- eDNC registry key ---
+$ednRegPathWin = 'SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General'
+try {
+    $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($ednRegPathWin, $true)
+    if ($regKey) {
+        $regSec = $regKey.GetAccessControl()
+        $rule = New-Object System.Security.AccessControl.RegistryAccessRule(
+            'BUILTIN\Users', 'SetValue', 'Allow')
+        $regSec.AddAccessRule($rule)
+        $regKey.SetAccessControl($regSec)
+        $regKey.Close()
+        Write-Host "  eDNC reg: BUILTIN\Users granted SetValue on HKLM:\$ednRegPathWin"
+    } else {
+        Write-Host "  eDNC registry key not found - skipping (eDNC not installed?)" -ForegroundColor DarkGray
+    }
+} catch {
+    Write-Warning "  Failed to set ACL on HKLM:\$ednRegPathWin : $_"
+}
+
+Write-Host "ACL setup complete."
+try { Stop-Transcript | Out-Null } catch {}