Display: install the ShopDB enforce client once AESFMA is reachable

A PXE-imaged display ends up with no GE-Enforce client at all. Confirmed on
579C144, 2026-08-06:

    is the client installed?            NOT FOUND
    scheduled tasks that would run it?  NONE

Not a broken configuration - nothing had ever tried. Install-ShopdbKiosk.ps1
downloads itself from {BaseUrl}/installers/kiosk over HTTPS, and ShopDB is only
reachable after the bay joins the AESFMA wifi SSID, so it cannot run during
imaging. Nothing was arranged to run it afterwards.

09-Setup-Display.ps1 now registers 'ShopDB Kiosk Bootstrap' as a SYSTEM task at
boot and every 15 minutes. Install-ShopdbKiosk-WhenOnline.ps1 does nothing until
ShopDB answers, then runs the vendor installer once, verifies BaseUrl and the
enforce task exist, deletes the staged key and unregisters itself. A bay cabled
up days later still self-configures.

It deliberately does not reimplement the installer - it waits, invokes, verifies
and cleans up, so the vendor script can be replaced wholesale without touching
this.

The key file is LABELLED (collector=, fetch=) rather than positional. The two
tokens are not interchangeable and a mix-up is silent: a fetch token in the
collector slot leaves asset reporting broken while everything looks configured.
A bare unlabelled line is ignored rather than guessed at. Missing keys are not
fatal - the fetch token is unnecessary on an IP-allowlisted subnet, and the
installer skips the asset-report task rather than failing.

Staged on the share: the bootstrap, the vendor installer under kiosk\, and the
updated display setup. The key itself is NOT staged yet - see the commit
discussion; it needs to be labelled with which scope it carries first.

playbook/shopfloor-setup/gea-shopfloor-display/09-Setup-Display.ps1

@@ -52,6 +52,40 @@ Write-Host "  Edge RelaunchNotificationPeriod=1h"
 Write-Host "  Edge RelaunchHeadsUpPeriod=1m"
 Write-Host "  Edge RelaunchWindow=02:00-04:00"
 
+# --- Arm the ShopDB kiosk bootstrap -------------------------------------
+# A PXE-imaged display ends up with no GE-Enforce client: the installer pulls
+# itself from {BaseUrl}/installers/kiosk over HTTPS, and ShopDB is unreachable
+# until the bay joins the AESFMA wifi SSID. So it cannot run now.
+#
+# Register a SYSTEM task that does nothing until ShopDB answers, then runs the
+# vendor installer once and unregisters itself. At boot and every 15 minutes,
+# so a bay cabled up days later still self-configures.
+Write-Host '=== Arming ShopDB kiosk bootstrap ==='
+$bootstrap = Join-Path $PSScriptRoot 'Install-ShopdbKiosk-WhenOnline.ps1'
+$taskName  = 'ShopDB Kiosk Bootstrap'
+
+if (-not (Test-Path $bootstrap)) {
+    Write-Warning "  $bootstrap not found - kiosk will NOT self-configure. Tell the PXE admin."
+} else {
+    try {
+        $action = New-ScheduledTaskAction -Execute 'powershell.exe' `
+                    -Argument ('-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "{0}" -TaskName "{1}"' -f $bootstrap, $taskName)
+        $trigBoot = New-ScheduledTaskTrigger -AtStartup
+        $trigRep  = New-ScheduledTaskTrigger -Once -At (Get-Date).AddMinutes(5) `
+                      -RepetitionInterval (New-TimeSpan -Minutes 15)
+        $principal = New-ScheduledTaskPrincipal -UserId 'SYSTEM' -LogonType ServiceAccount -RunLevel Highest
+        $settings  = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries `
+                      -StartWhenAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 30)
+        Register-ScheduledTask -TaskName $taskName -Action $action `
+                      -Trigger @($trigBoot, $trigRep) -Principal $principal -Settings $settings `
+                      -Force -ErrorAction Stop | Out-Null
+        Write-Host "  Registered '$taskName' (at boot + every 15 min, SYSTEM)"
+        Write-Host "  It waits for ShopDB, installs the enforce client, then removes itself."
+    } catch {
+        Write-Warning "  Failed to register '$taskName': $_"
+    }
+}
+
 if (Get-Command Send-PxeStatus -ErrorAction SilentlyContinue) {
     Send-PxeStatus -Stage '09-Setup-Display: complete' -StageIndex 4 -StageTotal 8
 }