fix(shopfloor): clear imaging AutoLogonCount at ShopFloor handover

Run-ShopfloorSetup and Stage-Dispatcher top AutoLogonCount up to 10 so
SupportUser survives vendor-forced reboots. Sysinternals Autologon, which
lockdown uses to switch the bay to ShopFloor, leaves the counter in place,
so ShopFloor inherited the remainder. Windows counts it down on every
autologon and at 0 sets AutoAdminLogon=0: the bay boots to a ShopFloor
password prompt a few reboots after imaging.

Delete the counter once Winlogon shows ShopFloor:
- Monitor-IntuneProgress.ps1, on the poll that sees the handover
- SetShopfloorAutoLogon.bat, after sfld_autologon.ps1
- Force-Lockdown.bat, on success

The SupportUser top-ups stay. Tested in the win11 VM: the Monitor block
removes the counter for ShopFloor, keeps it for SupportUser, and is a
no-op when clean; both batch files leave ShopFloor autologon on with no
counter.

playbook/shopfloor-setup/Shopfloor/Force-Lockdown.bat

@@ -70,6 +70,10 @@ if "%RC%"=="0" (
     if not exist "C:\Enrollment" mkdir "C:\Enrollment"
     > "C:\Enrollment\force-lockdown-applied.txt" echo %DATE% %TIME%
     echo Marker written: C:\Enrollment\force-lockdown-applied.txt
+    REM Clear the imaging AutoLogonCount: Autologon leaves it in place and
+    REM ShopFloor autologon switches itself off when it counts down to 0.
+    reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /f /reg:64 >nul 2>&1
+    echo Cleared leftover AutoLogonCount.
 )
 
 echo.

playbook/shopfloor-setup/Shopfloor/SetShopfloorAutoLogon.bat

@@ -10,3 +10,8 @@ if %errorlevel% neq 0 (
 
 
 "C:\Program Files\PowerShell\7\pwsh.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\Sysinternals\sfld_autologon.ps1"
+
+REM 2) Clear any leftover imaging AutoLogonCount. Imaging tops it up for
+REM    SupportUser and Autologon leaves it in place, so ShopFloor autologon
+REM    would switch itself off again when it counts down to 0.
+reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /f /reg:64 >nul 2>&1

playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1

@@ -249,6 +249,27 @@ function Get-Phase1 {
     # the force-lockdown marker has been written by sfld_autologon.ps1.
     # When either signal is present, push idx=8 / status=succeeded so the
     # dashboard card flips to 100% green.
+
+    # Lockdown handover also ends the imaging autologon budget.
+    # Run-ShopfloorSetup and Stage-Dispatcher top AutoLogonCount up to 10 for
+    # SupportUser, and the Sysinternals Autologon run that switches the bay to
+    # ShopFloor leaves it in place. ShopFloor then inherited the remainder and
+    # Windows turned autologon off when it reached 0 - the bay parked at a
+    # ShopFloor password prompt a few reboots after imaging. Delete it as soon
+    # as Winlogon shows ShopFloor. Proven in the win11 VM 2026-10-02. GE-Enforce
+    # common carries the same cleanup (Remove-AutoLogonCount.ps1) for bays
+    # imaged before this.
+    try {
+        $wlKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon'
+        $wlNow = Get-ItemProperty $wlKey -ErrorAction Stop
+        if ($wlNow.DefaultUserName -like 'ShopFloor*' -and $null -ne $wlNow.AutoLogonCount) {
+            Remove-ItemProperty $wlKey -Name AutoLogonCount -ErrorAction Stop
+            Write-Host "Removed leftover AutoLogonCount ($($wlNow.AutoLogonCount)) after ShopFloor handover"
+        }
+    } catch {
+        Write-Warning "Could not clear AutoLogonCount: $_"
+    }
+
     if (-not $script:cache.LockdownCompletePushed) {
         $lockdownApplied = $false
         try {