Deploy the site config bays actually read, and close the drift gate

The shortcut fix from e844ff3 has been live in git and absent from the floor
since 2026-08-06. site-config.json exists TWICE on the share, from one repo
source: enrollment/shopfloor-setup/ and enrollment/config/. Only the second one
is staged to a bay - startnet copies Y:\config\site-config.json to
W:\Enrollment\site-config.json - and it was the stale one.

So every bay imaged in the last two weeks came up without the Plant Apps startup
item and without the Defect_Tracker taskbar pin, while the drift report showed
site-config.json in sync, because it was reading the copy nothing consumes. A
green check on the wrong file is worse than no check.

Deployed the repo copy over it (backup on the server at
~/backups/site-config.json.bak-20260819) and marked BOTH destinations git-owned,
so neither can go stale behind the other.

The shopfloor unattend is reconciled the other way round. Live was 87 lines ahead
of the repo - the default-user startup-delay removal, the Windows Update
disables, the removable-media block that stops PPKG auto-detection at OOBE, and
the run-enrollment.ps1 path fix from C:\ to C:\Enrollment. The repo copy was a
201-line fossil. LIVE WINS: these files boot machines, and pushing the repo copy
over them is exactly the 2026-08-06 outage that prompted this tool. Adopted live
into the repo verbatim (lint clean) rather than merging by hand.

Also fixed a pair that could never pass: the engineer unattend was compared
against playbook/FlatUnattendW10.xml, which is the STANDARD answer file, so it
reported DIFFERS permanently. 6f86c81 added FlatUnattendW10-engineer.xml but did
not repoint the pair at it. A permanently red row is one nobody reads, which is
how the site-config gap stayed invisible next to it.

All twelve pairs are now git-owned and in sync, and the gate has nothing left
classified as "known bad" to hide behind.

scripts/share-drift.py

@@ -63,21 +63,30 @@ PAIRS = [
     ("playbook/shopfloor-setup/BIOS/check-bios.cmd",
      "/srv/samba/winpeapps/_shared/BIOS/check-bios.cmd", GIT_OWNED),
 
-    # The config/ copy is what startnet stages to C:\Enrollment\site-config.json
-    # and it has its own edit history - it carried the dead tsgwp00524 host that
-    # the repo copy never had. Same filename, different lineage.
+    # The config/ copy is the one startnet actually stages to
+    # C:\Enrollment\site-config.json, so it is the copy every bay reads. It had
+    # its own edit history and sat stale since 2026-08-06, which meant bays
+    # imaged after e844ff3 quietly lost the Plant Apps startup item and the
+    # Defect_Tracker pin - while the sibling copy under shopfloor-setup/ showed
+    # perfectly in sync and made the pair look healthy. Reconciled 2026-08-19 by
+    # deploying the repo copy over it. One source file, two destinations, both
+    # git-owned now, so a stale one cannot hide behind the other again.
     ("playbook/shopfloor-setup/site-config.json",
-     "/srv/samba/enrollment/config/site-config.json", UNRECONCILED),
+     "/srv/samba/enrollment/config/site-config.json", GIT_OWNED),
 
-    # The live unattends are the ones that boot machines and they are FAR ahead
-    # of the repo copies (17 KB vs 12 KB). Pushing the repo over them would
-    # regress production. Reconcile before promoting to git-owned.
+    # All three unattends are reconciled. The live files were ahead of the repo
+    # and the LIVE side won, because these are what boot machines - pushing the
+    # repo over them is precisely the 2026-08-06 outage.
+    #
+    # Engineer has its own repo file. It used to be compared against the
+    # standard unattend, which is a different answer file, so the pair reported
+    # DIFFERS permanently - and a light that is always red is one nobody reads.
     ("playbook/FlatUnattendW10-shopfloor.xml",
-     "/srv/samba/winpeapps/gea-shopfloor/Deploy/FlatUnattendW10.xml", UNRECONCILED),
+     "/srv/samba/winpeapps/gea-shopfloor/Deploy/FlatUnattendW10.xml", GIT_OWNED),
     ("playbook/FlatUnattendW10.xml",
-     "/srv/samba/winpeapps/gea-standard/Deploy/FlatUnattendW10.xml", UNRECONCILED),
-    ("playbook/FlatUnattendW10.xml",
-     "/srv/samba/winpeapps/gea-engineer/Deploy/FlatUnattendW10.xml", UNRECONCILED),
+     "/srv/samba/winpeapps/gea-standard/Deploy/FlatUnattendW10.xml", GIT_OWNED),
+    ("playbook/FlatUnattendW10-engineer.xml",
+     "/srv/samba/winpeapps/gea-engineer/Deploy/FlatUnattendW10.xml", GIT_OWNED),
 ]