Decouple wired-NIC re-enable from DeviceId capture

Previous logic bundled re-enable into the idx=7 DeviceId-push gate.
If DeviceId hadn't been captured yet (AAD join lag, dsregcmd parse
miss), re-enable never fired even though the Report IP log was
already sitting at C:\Logs\GE_Report_IP_Address*.txt and the NIC
state file was on disk.

Split into two independent checks per tick:
 1. Re-enable: triggered by (Report IP log) AND (NIC state file) only.
 2. idx=7 push: still gated on (DeviceId) AND (Report IP log).

Fixes case observed in field: file exists in C:\Logs but wired NICs
stayed off and the bay couldn't reach the PXE dashboard for idx=7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/lib/Monitor-IntuneProgress.ps1

@@ -222,25 +222,17 @@ function Get-Phase1 {
         } catch {}
     }
 
-    # Push DeviceId to the PXE dashboard exactly once (the imaging.html card
-    # renders a QR of it). Gated on Report IP log existing: Run-ShopfloorSetup
-    # disabled wired NICs after stage 2 push so GE's Report IP webhook only
-    # sees the corp-WiFi IP. We wait for the log file to appear (proof Report
-    # IP fired clean), re-enable the NICs we recorded, sleep a tick so the
-    # interface comes back up, then push idx=7. Until the log exists, Phase 1
-    # stays "in progress" on the dashboard - which is correct, the bay is
-    # not actually "done with registration" until the Report IP step has
-    # cleared.
-    if ($script:cache.DeviceId -and -not $script:cache.DeviceIdReported) {
+    # Report IP log presence drives two independent actions that USED to be
+    # bundled inside the DeviceId-push gate. Splitting them so re-enable
+    # fires even if DeviceId hasn't been captured yet (e.g. AAD join lag,
+    # dsregcmd parse miss):
+    #
+    # 1. Re-enable wired NICs as soon as the log lands + state file exists.
+    # 2. Push idx=7 once DeviceId is captured AND the log exists.
     $reportIpLog = Get-ChildItem -Path 'C:\Logs\GE_Report_IP_Address*.txt' -ErrorAction SilentlyContinue |
                    Select-Object -First 1
-        if ($reportIpLog) {
-            # Re-enable any wired NICs Run-ShopfloorSetup disabled. Quick
-            # before the eventual Intune-driven reboot fires so the bay
-            # gets a clean wired path back to the PXE dashboard for idx=7
-            # + idx=8 pushes.
     $nicListFile = 'C:\Enrollment\disabled-wired-nics.txt'
-            if (Test-Path $nicListFile) {
+    if ($reportIpLog -and (Test-Path $nicListFile)) {
         try {
             $nicNames = Get-Content $nicListFile -ErrorAction Stop
             foreach ($n in $nicNames) {
@@ -255,6 +247,9 @@ function Get-Phase1 {
         }
     }
 
+    # Push DeviceId / idx=7 once, when both DeviceId is captured and the
+    # Report IP log has landed (dashboard QR renders from DeviceId).
+    if ($script:cache.DeviceId -and -not $script:cache.DeviceIdReported -and $reportIpLog) {
         Ensure-SendPxeStatus
         if (Get-Command Send-PxeStatus -ErrorAction SilentlyContinue) {
             try {
@@ -265,7 +260,6 @@ function Get-Phase1 {
             } catch { }
         }
     }
-    }
 
     # Lockdown-applied auto-completion. Fleet-wide reality: bays use a LOCAL
     # ShopFloor account, so AzureAdPrt stays NO and user-scoped Intune policies