Engineering Layer: survive the C:\Deploy cleanup; the employee gets the icon

Engineer builds left the employee without "Configure my Engineering
Layer". First logon ran C:\Deploy\Applications\extra_engineering\
Install-EngineeringLayer.ps1, and the script itself lived in C:\Deploy:
std/eng have no autologon, so a PC that rebooted before the employee
signed in had lost C:\Deploy to the orchestrator's DeleteDeployDir task,
and nothing installed, silently.

- engineer unattend, specialize Order 37 (free slot): run the script with
  -StageOnly, copying the payload and the script to C:\PreInstall\engineering
  while C:\Deploy exists (Path 119 chars)
- first logon Order 11: run it from C:\PreInstall\engineering, falling back
  to C:\Deploy if staging did not happen
- the script (now in the repo, playbook/engineering/; it lived only on the
  server): after the install, restore the Public desktop icon if it is
  missing and the PC is not configured yet (no C:\TMP\DUU_Complete.log), and
  register Active Setup so each later user gets the icon on their own
  desktop when the Public one is gone. v3.1 puts the icon on the Public
  desktop; clicking it (configure, from GE's V: share) deletes it for all
- playbook deploys the script to gea-engineer extra_engineering; the 650 MB
  payload stays site content (documented in SITE-CUSTOMIZATION.md)

Tested in the win11 VM with the exact unattend strings and a stand-in
installer that skips the icon: specialize staged payload and script;
C:\Deploy deleted; first logon installed from the staged copy, restored the
icon and registered Active Setup. The per-user step as a new user: icon on
their desktop when the PC is unconfigured and the Public icon is gone; none
when configured or when the Public icon is there. Lint clean. Not deployed:
unattends go out only through scripts/deploy-unattend.sh.

playbook/FlatUnattendW10-engineer.xml

@@ -258,6 +258,16 @@
           <Path>cmd /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Windows Search" /v EnableDynamicContentInWSB /t REG_DWORD /d 0 /f</Path>
           <Description>Disable Search Highlights</Description>
         </RunSynchronousCommand>
+				<RunSynchronousCommand wcm:action="add">
+					<Order>37</Order>
+					<Path>powershell.exe -NoP -EP Bypass -File "C:\Deploy\Applications\extra_engineering\Install-EngineeringLayer.ps1" -StageOnly</Path>
+					<!-- Copies the Engineering Layer payload and the script itself to
+					     C:\PreInstall\engineering now, while C:\Deploy certainly exists. The
+					     first-logon install (oobeSystem Order 11) runs from there: a PC that
+					     reboots before the employee signs in has lost C:\Deploy to the
+					     orchestrator's DeleteDeployDir task by then. -->
+					<Description>Engineering Layer: stage payload out of C:\Deploy</Description>
+				</RunSynchronousCommand>
       
 				<RunSynchronousCommand wcm:action="add">
 					<Order>39</Order>
@@ -382,14 +392,15 @@
 				</SynchronousCommand>
             <SynchronousCommand wcm:action="add">
                 <Order>11</Order>
-                <CommandLine>powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Deploy\Applications\extra_engineering\Install-EngineeringLayer.ps1"</CommandLine>
-                <!-- Copies the 653 MB payload out of C:\Deploy to C:\PreInstall\engineering
-					     BEFORE installing: the bulk-enrollment orchestrator registers a
-					     DeleteDeployDir task that removes C:\Deploy on the next boot, and this
-					     installer (.NET 3.5, VC++, Cygwin, DUU) can reboot part way through.
-					     Idempotent, marker-gated. Description is capped at 256 chars, so the
-					     detail lives here. -->
-					<Description>Engineering Layer: stage payload out of C:\Deploy then install</Description>
+                <CommandLine>cmd /c if exist "C:\PreInstall\engineering\Install-EngineeringLayer.ps1" (powershell.exe -NoP -EP Bypass -File "C:\PreInstall\engineering\Install-EngineeringLayer.ps1") else (powershell.exe -NoP -EP Bypass -File "C:\Deploy\Applications\extra_engineering\Install-EngineeringLayer.ps1")</CommandLine>
+                <!-- Installs from the copy specialize Order 37 staged in
+					     C:\PreInstall\engineering, so it works after a reboot has removed
+					     C:\Deploy (DeleteDeployDir). Falls back to C:\Deploy if staging did not
+					     happen. The installer (.NET 3.5, VC++, Cygwin, DUU) can reboot part way
+					     through; the script is idempotent and marker-gated, and it makes sure
+					     the "Configure my Engineering Layer" icon reaches the employee.
+					     Description is capped at 256 chars, so the detail lives here. -->
+					<Description>Engineering Layer: install from the staged copy</Description>
             </SynchronousCommand>
 				<SynchronousCommand wcm:action="add">
 					<CommandLine>powershell.exe -NoP -EP Bypass -File C:\ProgramData\PxeStatus\Send-ImagingStage.ps1 -PCType gea-engineer -StageIndex 5 -Stage "Setup complete - enrollment continues on the PC" -Status succeeded</CommandLine>