GE-Enforce: prefer DNC reg MachineNo over machine-number.txt

machine-number.txt holds the imaging-time MN. PCs imaged with
placeholder 9999 (tech intends to flip via Set-MachineNumber later)
keep 9999 in that file even after Update-MachineNumber writes the
real MN to HKLM:\...\Dnc\General\MachineNo. Status.json was reporting
9999 across the fleet because of this.

Now reads DNC reg first; only falls back to machine-number.txt if reg
is missing or also 9999. Existing convergence-check.txt unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/common/GE-Enforce.ps1

@@ -280,11 +280,27 @@ try {
             }
         }
 
+        # Prefer DNC reg (authoritative post-Update-MachineNumber) over
+        # machine-number.txt (imaging-time placeholder, often 9999 if tech
+        # imaged with placeholder + bay assignment came later).
         $machineNumber = ''
         try {
+            $regPaths = @(
+                'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\Dnc\General',
+                'HKLM:\SOFTWARE\GE Aircraft Engines\Dnc\General'
+            )
+            foreach ($rp in $regPaths) {
+                if (Test-Path $rp) {
+                    $v = (Get-ItemProperty -Path $rp -Name MachineNo -ErrorAction SilentlyContinue).MachineNo
+                    if ($v -and $v -ne '9999') { $machineNumber = "$v"; break }
+                }
+            }
+            # Fall back to enrollment file (will be 9999 for placeholder PCs)
+            if (-not $machineNumber) {
                 if (Test-Path 'C:\Enrollment\machine-number.txt') {
                     $machineNumber = (Get-Content 'C:\Enrollment\machine-number.txt' -First 1 -ErrorAction SilentlyContinue).Trim()
                 }
+            }
         } catch {}
 
         $status = [ordered]@{