GE-Enforce: backfill Keyence pc-subtype.txt from installed ProductCode

Pre-2026-05 Keyence images didn't write pc-subtype.txt via startnet.cmd. Without
a subtype the share manifest's per-model PCTypes gate falls back to the default
(VR-6000), causing the wrong model to install on VR-3000 / VR-5000 boxes.
Detect the installed VR-3000/5000/6000 by its uninstall ProductCode and
persist the subtype so subsequent GE-Enforce cycles + the share manifest gate
route correctly.

playbook/shopfloor-setup/common/GE-Enforce.ps1

@@ -76,6 +76,40 @@ $pcType    = (Get-Content -LiteralPath $pcTypeFile -First 1 -ErrorAction Silentl
 $pcSubType = if (Test-Path $pcSubTypeFile) {
     (Get-Content -LiteralPath $pcSubTypeFile -First 1 -ErrorAction SilentlyContinue).Trim()
 } else { '' }
+
+# Backfill pc-subtype.txt on Keyence PCs imaged before 2026-05 (startnet.cmd
+# didn't write pc-subtype.txt for Keyence then). Without a subtype, the share
+# manifest's per-model PCTypes gate falls back to installing the default model
+# (VR-6000) on top of VR-3000 / VR-5000 boxes. Detect the installed model from
+# its uninstall ProductCode and persist the subtype so subsequent GE-Enforce
+# cycles + the share manifest gate route correctly.
+if ($pcType -ieq 'keyence' -and -not $pcSubType) {
+    $keyenceProducts = @(
+        @{ Subtype = 'vr3000'; Path = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9CC9A062-2A93-4D3B-AECA-F70C691A46F2}' },
+        @{ Subtype = 'vr5000'; Path = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AF7E8B93-DBEB-4DB1-91CB-4DA592D8E222}' },
+        @{ Subtype = 'vr6000'; Path = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{058E7194-BDF8-4FA2-9D69-978BB0F25214}' }
+    )
+    foreach ($p in $keyenceProducts) {
+        if (Test-Path -LiteralPath $p.Path) {
+            $pcSubType = $p.Subtype
+            try {
+                $enrollDir = Split-Path -Parent $pcSubTypeFile
+                if (-not (Test-Path -LiteralPath $enrollDir)) {
+                    New-Item -Path $enrollDir -ItemType Directory -Force | Out-Null
+                }
+                Set-Content -LiteralPath $pcSubTypeFile -Value $pcSubType -Encoding ascii -Force
+                Write-EnforceLog "Backfilled pc-subtype.txt = $pcSubType from installed product code"
+            } catch {
+                Write-EnforceLog "pc-subtype.txt backfill write failed: $_" 'WARN'
+            }
+            break
+        }
+    }
+    if (-not $pcSubType) {
+        Write-EnforceLog "Keyence PC with no pc-subtype.txt and no recognized VR product installed - skipping model-gated apps until imaging populates subtype" 'WARN'
+    }
+}
+
 Write-EnforceLog "PCType: $pcType$(if ($pcSubType) { " / $pcSubType" })"
 
 # --- site-config ---