sync_intune.bat: longer poll interval, in-place status, no sync flood

Two related fixes for the desktop helper:

1. Stop hammering the Intune sync trigger every 15 seconds. The old
   loop called :do_sync (Start-ScheduledTask on Schedule #3) on every
   failed check, which started a fresh CSP pull before the previous
   one had time to complete - the Intune engine treats a re-trigger
   as "start over" and kills in-flight policy application work, so
   nothing ever finished. New cadence: trigger sync once at the start
   of each step, then poll every 30 s, only re-trigger every 6 polls
   (~3 min). POLL_SECS and RETRIGGER_POLLS are top-of-script knobs.

2. Stop pushing the QR code off the top of the window. The old loop
   echoed "Checking again in 15s..." on a new line every iteration,
   so after a few minutes the QR code (which contains the device ID
   the operator scans) had scrolled out of view. Replaced the per-
   iteration echo with a single self-redrawing status line using a
   captured CR character (copy /Z trick) and <nul set /p, padded to
   clear leftover characters. Important transitions ("Re-triggering
   sync...", "[DONE] ...") still print echo. lines so they survive in
   the scrollback as permanent history.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/sync_intune.bat

@@ -9,6 +9,11 @@ if !errorlevel! neq 0 (
     exit /b
 )
 
+:: Capture a carriage return character so the polling status line can overwrite
+:: itself in place (instead of scrolling the QR code off the top of the window).
+:: The copy /Z trick is the standard batch idiom for getting a literal CR.
+for /f %%a in ('copy /Z "%~f0" nul') do set "CR=%%a"
+
 echo.
 echo ========================================
 echo   Intune Policy Sync - %COMPUTERNAME%
@@ -48,15 +53,37 @@ echo   Step 3: SFLD - Consume Credentials task
 echo ========================================
 echo.
 
+:: ---- Polling cadence ----
+:: An Intune policy pull (Schedule #3 task) typically takes 30-90 seconds end-to-end.
+:: We poll every POLL_SECS but only RE-TRIGGER sync every RETRIGGER_POLLS iterations
+:: (so the previous sync has time to actually complete before we kick a new one).
+:: Old version called do_sync every 15s, which started a fresh sync before the prior
+:: one had finished and the Intune CSP engine treated each re-trigger as "start over",
+:: killing in-flight policy application work.
+set "POLL_SECS=30"
+set "RETRIGGER_POLLS=6"
+
 :: ---- STEP 1: Wait for SFLD registry key ----
 echo [Step 1/3] Waiting for SFLD device configuration...
+echo   Triggering initial Intune sync...
+call :do_sync
+set "poll_count=0"
 
 :poll_sfld
 reg query "HKLM\Software\GE\SFLD" >nul 2>&1
-if !errorlevel! equ 0 goto sfld_done
-call :do_sync
-echo   Checking again in 15s...
-timeout /t 15 /nobreak >nul
+if !errorlevel! equ 0 (
+    echo.
+    goto sfld_done
+)
+set /a poll_count+=1
+set /a remainder=!poll_count! %% !RETRIGGER_POLLS!
+if !remainder! equ 0 (
+    echo.
+    echo   Still waiting after !poll_count! checks - re-triggering sync...
+    call :do_sync
+)
+<nul set /p "=!CR!  Check #!poll_count! - next check in !POLL_SECS!s...                    "
+timeout /t !POLL_SECS! /nobreak >nul
 goto poll_sfld
 
 :sfld_done
@@ -65,6 +92,9 @@ echo   [DONE] SFLD device configuration received.
 :: ---- STEP 2: Wait for DSC install completion ----
 echo.
 echo [Step 2/3] Waiting for DSC installation to complete...
+echo   Triggering initial Intune sync...
+call :do_sync
+set "poll_count=0"
 
 :poll_dsc
 set "dsc_ok=0"
@@ -72,10 +102,19 @@ if exist "C:\LOGS\SFLD\DSCInstall.log" (
     findstr /C:"Installation completed successfully" "C:\LOGS\SFLD\DSCInstall.log" >nul 2>&1
     if !errorlevel! equ 0 set "dsc_ok=1"
 )
-if !dsc_ok! equ 1 goto dsc_done
-call :do_sync
-echo   Checking again in 15s...
-timeout /t 15 /nobreak >nul
+if !dsc_ok! equ 1 (
+    echo.
+    goto dsc_done
+)
+set /a poll_count+=1
+set /a remainder=!poll_count! %% !RETRIGGER_POLLS!
+if !remainder! equ 0 (
+    echo.
+    echo   Still waiting after !poll_count! checks - re-triggering sync...
+    call :do_sync
+)
+<nul set /p "=!CR!  Check #!poll_count! - next check in !POLL_SECS!s...                    "
+timeout /t !POLL_SECS! /nobreak >nul
 goto poll_dsc
 
 :dsc_done
@@ -84,13 +123,25 @@ echo   [DONE] DSC installation completed successfully.
 :: ---- STEP 3: Wait for Consume Credentials scheduled task ----
 echo.
 echo [Step 3/3] Waiting for SFLD - Consume Credentials task...
+echo   Triggering initial Intune sync...
+call :do_sync
+set "poll_count=0"
 
 :poll_task
 schtasks /query /tn "SFLD - Consume Credentials" >nul 2>&1
-if !errorlevel! equ 0 goto task_done
-call :do_sync
-echo   Checking again in 15s...
-timeout /t 15 /nobreak >nul
+if !errorlevel! equ 0 (
+    echo.
+    goto task_done
+)
+set /a poll_count+=1
+set /a remainder=!poll_count! %% !RETRIGGER_POLLS!
+if !remainder! equ 0 (
+    echo.
+    echo   Still waiting after !poll_count! checks - re-triggering sync...
+    call :do_sync
+)
+<nul set /p "=!CR!  Check #!poll_count! - next check in !POLL_SECS!s...                    "
+timeout /t !POLL_SECS! /nobreak >nul
 goto poll_task
 
 :task_done