Add Acrobat Reader logon enforcer (cross-PC-type), provtool.exe arg fix

Acrobat Reader enforcement:
- playbook/shopfloor-setup/common/ is the cross-PC-type staging dir. Mirrors
  CMM/ structure (enforce script + its Install-FromManifest copy + manifest
  template + register script).
- Acrobat-Enforce.ps1 runs as SYSTEM on every logon, reads
  acrobatSharePath from site-config.common, mounts the SFLD share with
  the same HKLM-backed credential lookup CMM-Enforce uses, hands the
  acrobat-manifest.json from the share to Install-FromManifest.
- Install-FromManifest extended with Type=CMD so it can invoke vendor-
  supplied .cmd wrappers (Install-AcroReader.cmd does a two-step MSI+MSP
  install that does not fit MSI/EXE types cleanly). cmd.exe /c wraps it
  because UseShellExecute=false cannot launch .cmd directly.
- Register-AcrobatEnforce.ps1 stages scripts to C:\Program Files\GE\Acrobat
  and registers "GE Acrobat Enforce" scheduled task. Called from
  Run-ShopfloorSetup.ps1 right before the enrollment (PPKG) step so it
  applies to every PC type, not just CMM.
- acrobat-manifest.template.json is the repo reference; the authoritative
  copy lives on the SFLD share at
  \\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\common\acrobat\
  Bumping Acrobat updates = drop new MSP on share, bump DetectionValue in
  manifest; enforcer catches every PC on next logon.
- site-config.json: add "common": { "acrobatSharePath": ... }. Uses a
  new top-level block rather than a PC-type-specific one since Acrobat
  applies everywhere.

Initial install still happens via the preinstall flow
(Install-AcroReader.cmd during WinPE). The enforcer is the ongoing-
updates side; on a freshly-imaged PC detection passes and it no-ops.

Also in this commit:
- run-enrollment.ps1: provtool.exe argument syntax fix. First test
  returned 0x80004005 E_FAIL in 1s because /ppkg: and /log: are not
  valid provtool flags; the cmdlet's internal call used positional
  path + /quiet + /source. Switched to that syntax.

playbook/shopfloor-setup/Run-ShopfloorSetup.ps1

@@ -233,6 +233,20 @@ if (Test-Path -LiteralPath $monitorScript) {
 reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoLogonCount /t REG_DWORD /d 4 /f | Out-Null
 Write-Host "Auto-logon set to 4 remaining logins."
 
+# --- Register cross-PC-type enforcers (Acrobat, etc.) ---
+# These run on every logon regardless of PC type, mounting the SFLD share
+# for version-pinned app enforcement. Initial install already handled by
+# preinstall flow; enforcers only kick in when detection fails.
+$commonSetupDir = Join-Path $PSScriptRoot 'common'
+$registerAcrobat = Join-Path $commonSetupDir 'Register-AcrobatEnforce.ps1'
+if (Test-Path -LiteralPath $registerAcrobat) {
+    Write-Host ""
+    Write-Host "=== Registering Acrobat enforcer ==="
+    try { & $registerAcrobat } catch { Write-Warning "Acrobat enforce registration failed: $_" }
+} else {
+    Write-Host "Register-AcrobatEnforce.ps1 not found (optional) - skipping"
+}
+
 # --- Run enrollment (PPKG install) ---
 # Enrollment is the LAST thing we do. Install-ProvisioningPackage triggers
 # an immediate reboot -- everything after this call is unlikely to execute.