Verify staging in WinPE, harvest imaging logs, make enrollment run once

Three changes aimed at the same failure mode: a bay that images green and is
silently unusable, diagnosed only by walking over and copying files off by hand.

VERIFY STAGING (startnet, at :pctype_done)
Checks pc-type.txt, Run-ShopfloorSetup.ps1, shopfloor-setup/common and
shopfloor-setup/<PCTYPE> exist on the applied volume before anything depends on
them, retries the small trees once, and prints a loud banner if the retry does
not fix it. The enrollment package is checked but never blindly re-pulled - it is
8 GB, so a miss is reported instead.
Done here because a tech is still at the machine: a short copy found in WinPE
costs 30 seconds, the same copy found at first logon costs 20 minutes, and found
never costs a rebuild. Four Display bays sat green at stage 2 for weeks.

HARVEST LOGS (startnet, after PESetup exits)
Collects X:\*.log, the generated X:\Unattend.xml, PESetup's own log from the
target's Panther directory and winpe-staging.log into
\<server>\enrollment\imaging-logs\<serial>\, plus a build-context.txt naming
PCTYPE, PPKG, machine number and media. All of it was being discarded at reboot.
Runs after PESetup exits so the logs are final, which means re-mapping Y: since
cleanup already dropped it. Best-effort throughout - a bay must never fail to
reboot because a log copy failed.

W: WAIT CAP 20 -> 45 MINUTES
270 polls instead of 120. Fine on NVMe either way, but a WIM apply can exceed 20
minutes on slow media, and the failure mode is the os_not_found banner plus
nothing staged. The loop still exits the moment the SYSTEM hive appears.

RUN-ENROLLMENT RUNS ONCE
Marker at C:\Enrollment\.ppkg-applied, written on exit 0 and also on 0x800700B7
ERROR_ALREADY_EXISTS. Observed running twice on 579C144; the second pass
re-applied a pending rename over the package's own and otherwise did nothing.

Verified: startnet parens balance, every goto resolves, 899 CRLF lines with no
bare LF; run-enrollment parses clean under the PowerShell parser. Deployed -
boot.wim md5 159c2a4d, live run-enrollment dce9d50a.

playbook/shopfloor-setup/run-enrollment.ps1

@@ -19,6 +19,18 @@ function Log {
 
 Log "=== GE Aerospace GCCH Enrollment ==="
 
+# --- Run once ------------------------------------------------------------
+# This script has been observed running twice on one build (579C144,
+# 2026-08-06: 13:31:55 and 13:36:45). The second provtool call returned
+# 0x800700B7 ERROR_ALREADY_EXISTS and achieved nothing except re-applying a
+# pending computer rename over the one the package had just set. The rename is
+# gone now, but a second full pass is still pointless work on an 8 GB package.
+$appliedMarker = 'C:\Enrollment\.ppkg-applied'
+if (Test-Path $appliedMarker) {
+    Log "Provisioning package already applied on $(Get-Content $appliedMarker -First 1) - skipping."
+    return
+}
+
 # --- Find the .ppkg ---
 $ppkgFile = Get-ChildItem "C:\Enrollment\*.ppkg" -ErrorAction SilentlyContinue | Select-Object -First 1
 if (-not $ppkgFile) {
@@ -94,9 +106,20 @@ Log "PPKG diagnostic logs -> $ppkgLogDir (provtool writes them automatically)"
 try {
     $p = Start-Process -FilePath $provtool -ArgumentList $provArgs -Wait -PassThru -NoNewWindow -ErrorAction Stop
     Log "provtool.exe exit code: $($p.ExitCode)"
-    if ($p.ExitCode -ne 0) {
+    if ($p.ExitCode -eq 0) {
+        Set-Content -Path $appliedMarker -Value (Get-Date -Format 'yyyy-MM-dd HH:mm:ss') -ErrorAction SilentlyContinue
+        Log "Wrote applied-marker $appliedMarker"
+    } else {
         $hex = '0x{0:X8}' -f $p.ExitCode
         Log "WARNING: provtool.exe returned non-zero exit code ($hex). Check $ppkgLogDir for diagnostic bundle."
+        # 0x800700B7 ERROR_ALREADY_EXISTS means the package is already applied.
+        # That is a success for our purposes, and it is what a second run of
+        # this script produced on 579C144 (2026-08-06) - so mark it applied and
+        # let the next run skip instead of repeating the work.
+        if ($p.ExitCode -eq -2147024713) {
+            Set-Content -Path $appliedMarker -Value (Get-Date -Format 'yyyy-MM-dd HH:mm:ss') -ErrorAction SilentlyContinue
+            Log "Package was already applied (ERROR_ALREADY_EXISTS) - marker written."
+        }
     }
 } catch {
     Log "ERROR: Failed to launch provtool.exe: $_"