Configure-PC + nocollections ACL: align with two-task machine number design

- gea-shopfloor-nocollections/02-MachineNumberACLs.ps1: gut to no-op
  matching the collections variant. SYSTEM Apply task no longer needs
  per-user ACLs on the eDNC reg key or UDC ProgramData dir.

- Configure-PC.ps1 item 6 (Machine number logon prompt toggle):
  Stop duplicating Register-ScheduledTask logic inline. Call the
  shared Register-CheckMachineNumberTask.ps1 registrar so both the
  Prompt user-task and Apply SYSTEM-task are installed with matching
  SDDL config. Existence check now treats EITHER the new "Prompt
  Machine Number" task OR the legacy "Check Machine Number" task as
  "ON" so old bays still register correctly. Toggle OFF unregisters
  all three names (Prompt + Apply + legacy) for clean removal.

playbook/shopfloor-setup/gea-shopfloor-nocollections/02-MachineNumberACLs.ps1

@@ -1,81 +1,29 @@
-# 02-MachineNumberACLs.ps1 - Pre-grant write access on the UDC settings
-# file and eDNC registry key so that STANDARD (non-admin) users can update
-# the machine number via the Check-MachineNumber logon task without
-# elevation or a UAC prompt.
+# 02-MachineNumberACLs.ps1 - NO-OP (deprecated 2026-05-24).
 #
-# Runs during imaging as admin (type-specific Standard phase, after
-# 01-eDNC.ps1 has installed DnC). Only touches Standard PCs.
+# This script used to grant BUILTIN\Users SetValue on the eDNC reg key
+# and Modify on the UDC ProgramData dir so the logged-in user could
+# update machine number from the Check-MachineNumber logon dialog without
+# elevation.
 #
-# What gets opened up (narrow scope, not blanket admin):
-#   - C:\ProgramData\UDC\udc_settings.json  ->  BUILTIN\Users : Modify
-#   - HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General
-#                                            ->  BUILTIN\Users : SetValue
+# That design had two flaws:
+#   1. Security hole - any logged-in user could overwrite the machine-
+#      identity reg key.
+#   2. Fragile - ACL grants raced with eDNC install timing on some bays;
+#      the OpenSubKey call returned null + the grant was silently skipped,
+#      leaving Check-MachineNumber unable to update the bay (yet the old
+#      Update-MachineNumber.ps1 reported success anyway because
+#      Set-ItemProperty's PermissionDenied is non-terminating).
+#
+# Replaced by the two-task design in Register-CheckMachineNumberTask.ps1:
+#   - "Prompt Machine Number"  : user-context GUI, no privileges
+#   - "Apply Machine Number"   : SYSTEM-context worker, full HKLM access
+#
+# Left as a no-op so Stage-Dispatcher / Run-ShopfloorSetup discovery
+# patterns don't have to be updated. Existing bays' ACL grants are still
+# present and harmless (the SYSTEM Apply task ignores them).
 
-# --- Transcript ---
 $logDir = 'C:\Logs\SFLD'
 if (-not (Test-Path $logDir)) { try { New-Item -ItemType Directory -Path $logDir -Force | Out-Null } catch {} }
 try { Start-Transcript -Path (Join-Path $logDir '02-MachineNumberACLs.log') -Append -Force | Out-Null } catch {}
-
-# --- Skip on Timeclock sub-type (no UDC/eDNC to grant ACLs for) ---
-$subtypeFile = 'C:\Enrollment\pc-subtype.txt'
-if (Test-Path $subtypeFile) {
-    $subtype = (Get-Content $subtypeFile -First 1 -ErrorAction SilentlyContinue).Trim()
-    if ($subtype -eq 'Timeclock') {
-        Write-Host "02-MachineNumberACLs: skipped (Standard-Timeclock)"
-        try { Stop-Transcript | Out-Null } catch {}
-        return
-    }
-}
-
-Write-Host "02-MachineNumberACLs.ps1 starting $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
-Write-Host "Running as: $([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)"
-Write-Host ""
-Write-Host "Setting ACLs for standard-user machine number access..."
-
-# --- UDC settings directory ---
-# Set ACL on the DIRECTORY (not the file) with inheritance so that
-# udc_settings.json inherits the permission whenever UDC.exe creates it.
-# UDC_Setup.exe is killed by KillAfterDetection before UDC.exe writes the
-# JSON, so the file doesn't exist at this point. Directory-level ACL with
-# ContainerInherit + ObjectInherit covers any file created inside later.
-$udcDir = 'C:\ProgramData\UDC'
-if (Test-Path -LiteralPath $udcDir) {
-    try {
-        $acl = Get-Acl -LiteralPath $udcDir
-        $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
-            'BUILTIN\Users', 'Modify',
-            ([System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor
-             [System.Security.AccessControl.InheritanceFlags]::ObjectInherit),
-            [System.Security.AccessControl.PropagationFlags]::None,
-            'Allow')
-        $acl.AddAccessRule($rule)
-        Set-Acl -LiteralPath $udcDir -AclObject $acl -ErrorAction Stop
-        Write-Host "  UDC dir: BUILTIN\Users granted Modify (inherited) on $udcDir"
-    } catch {
-        Write-Warning "  Failed to set ACL on $udcDir : $_"
-    }
-} else {
-    Write-Host "  UDC dir not found at $udcDir - skipping (UDC not installed?)" -ForegroundColor DarkGray
-}
-
-# --- eDNC registry key ---
-$ednRegPathWin = 'SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General'
-try {
-    $regKey = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey($ednRegPathWin, $true)
-    if ($regKey) {
-        $regSec = $regKey.GetAccessControl()
-        $rule = New-Object System.Security.AccessControl.RegistryAccessRule(
-            'BUILTIN\Users', 'SetValue', 'Allow')
-        $regSec.AddAccessRule($rule)
-        $regKey.SetAccessControl($regSec)
-        $regKey.Close()
-        Write-Host "  eDNC reg: BUILTIN\Users granted SetValue on HKLM:\$ednRegPathWin"
-    } else {
-        Write-Host "  eDNC registry key not found - skipping (eDNC not installed?)" -ForegroundColor DarkGray
-    }
-} catch {
-    Write-Warning "  Failed to set ACL on HKLM:\$ednRegPathWin : $_"
-}
-
-Write-Host "ACL setup complete."
+Write-Host "02-MachineNumberACLs.ps1: no-op (replaced by SYSTEM Apply task - see Register-CheckMachineNumberTask.ps1)"
 try { Stop-Transcript | Out-Null } catch {}