Add Acrobat Reader logon enforcer (cross-PC-type), provtool.exe arg fix

Acrobat Reader enforcement:
- playbook/shopfloor-setup/common/ is the cross-PC-type staging dir. Mirrors
  CMM/ structure (enforce script + its Install-FromManifest copy + manifest
  template + register script).
- Acrobat-Enforce.ps1 runs as SYSTEM on every logon, reads
  acrobatSharePath from site-config.common, mounts the SFLD share with
  the same HKLM-backed credential lookup CMM-Enforce uses, hands the
  acrobat-manifest.json from the share to Install-FromManifest.
- Install-FromManifest extended with Type=CMD so it can invoke vendor-
  supplied .cmd wrappers (Install-AcroReader.cmd does a two-step MSI+MSP
  install that does not fit MSI/EXE types cleanly). cmd.exe /c wraps it
  because UseShellExecute=false cannot launch .cmd directly.
- Register-AcrobatEnforce.ps1 stages scripts to C:\Program Files\GE\Acrobat
  and registers "GE Acrobat Enforce" scheduled task. Called from
  Run-ShopfloorSetup.ps1 right before the enrollment (PPKG) step so it
  applies to every PC type, not just CMM.
- acrobat-manifest.template.json is the repo reference; the authoritative
  copy lives on the SFLD share at
  \\tsgwp00525.wjs.geaerospace.net\shared\dt\shopfloor\common\acrobat\
  Bumping Acrobat updates = drop new MSP on share, bump DetectionValue in
  manifest; enforcer catches every PC on next logon.
- site-config.json: add "common": { "acrobatSharePath": ... }. Uses a
  new top-level block rather than a PC-type-specific one since Acrobat
  applies everywhere.

Initial install still happens via the preinstall flow
(Install-AcroReader.cmd during WinPE). The enforcer is the ongoing-
updates side; on a freshly-imaged PC detection passes and it no-ops.

Also in this commit:
- run-enrollment.ps1: provtool.exe argument syntax fix. First test
  returned 0x80004005 E_FAIL in 1s because /ppkg: and /log: are not
  valid provtool flags; the cmdlet's internal call used positional
  path + /quiet + /source. Switched to that syntax.

playbook/shopfloor-setup/run-enrollment.ps1

@@ -55,15 +55,20 @@ Rename-Computer -NewName $newName -Force -ErrorAction SilentlyContinue
 $ppkgLogDir = "C:\Logs\PPKG"
 New-Item -ItemType Directory -Path $ppkgLogDir -Force -ErrorAction SilentlyContinue | Out-Null
 $provtool = Join-Path $env:SystemRoot 'System32\provtool.exe'
-$provArgs = "/ppkg:`"$($ppkgFile.FullName)`" /quiet /log:`"$ppkgLogDir\provtool.log`""
+# Arg order matches what the Install-ProvisioningPackage cmdlet invokes
+# internally (observed in ProvEventLog.txt): positional path, then /quiet,
+# then /source. No /log: or /ppkg: prefix - those are not valid provtool
+# flags and caused 0x80004005 E_FAIL in the first test.
+$provArgs = @("`"$($ppkgFile.FullName)`"", "/quiet", "/source", "BPRT")
 Log "Installing provisioning package via provtool.exe (no PowerShell timeout)..."
-Log "Command: $provtool $provArgs"
-Log "PPKG diagnostic logs -> $ppkgLogDir"
+Log "Command: $provtool $($provArgs -join ' ')"
+Log "PPKG diagnostic logs -> $ppkgLogDir (provtool writes them automatically)"
 try {
     $p = Start-Process -FilePath $provtool -ArgumentList $provArgs -Wait -PassThru -NoNewWindow -ErrorAction Stop
     Log "provtool.exe exit code: $($p.ExitCode)"
     if ($p.ExitCode -ne 0) {
-        Log "WARNING: provtool.exe returned non-zero exit code. Check $ppkgLogDir\provtool.log for details."
+        $hex = '0x{0:X8}' -f $p.ExitCode
+        Log "WARNING: provtool.exe returned non-zero exit code ($hex). Check $ppkgLogDir for diagnostic bundle."
     }
 } catch {
     Log "ERROR: Failed to launch provtool.exe: $_"