manifest engine: reg-first machine number + per-app crash isolation; add start-layout DSC

Install-FromManifest.ps1:
- Get-CurrentMachineNumber reads the eDNC/DNC registry FIRST (reassignment-
  authoritative), falling back to C:\Enrollment\machine-number.txt. The txt is
  written once at imaging and is NOT updated on reassignment, so txt-first
  gated reassigned bays on a stale number.
- Per-entry try/catch in the app loop: a single entry that throws no longer
  aborts the whole scope (skipping every later entry + the status write). It is
  logged, counted failed, and the loop continues. This was silently killing the
  collections scope at the MTConnect Makino entry, which also stopped the
  ShopDB asset reporter (a later entry) from ever running.

Deploy-ShopfloorStartLayout.ps1 (new): local-DSC port of the Intune
desktop-weblinks + Start-menu pins (copies .url/.lnk to Public Desktop +
All-Users Start Menu, writes the ConfigureStartPins JSON policy, resets
start2.bin + restarts the shell). Verified on Win11: pins render after logon.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/common/lib/Install-FromManifest.ps1

@@ -520,29 +520,35 @@ function Test-HostnameMatches {
 }
 
 # Machine-number filter. Stable identifier tied to the bay; survives PC
-# replacement at the same machine. Source of truth = the value the tech
-# entered at the PXE menu, persisted to C:\Enrollment\machine-number.txt
-# by startnet.cmd. Falls back to the DNC registry if that file is missing
-# (covers PCs that pre-date this filter being introduced).
+# replacement at the same machine.
+#
+# Source of truth = the eDNC/DNC registry MachineNo. That is what the
+# reassignment flow (Set-MachineNumber -> Update-MachineNumber) actually
+# rewrites when a bay is re-numbered (e.g. 9999 placeholder -> 7501). The
+# imaging-time C:\Enrollment\machine-number.txt is written ONCE by startnet.cmd
+# at the PXE menu and is NOT updated on reassignment, so it goes stale. Read
+# the registry FIRST so TargetMachineNumbers gating follows reassignment; fall
+# back to the txt only when the registry has no value (covers non-DNC PCs or a
+# bay where eDNC has not populated MachineNo yet).
 $script:_cachedMachineNumber = $null
 function Get-CurrentMachineNumber {
     if ($null -ne $script:_cachedMachineNumber) { return $script:_cachedMachineNumber }
-    $candidates = @(
-        'C:\Enrollment\machine-number.txt'
-    )
-    foreach ($p in $candidates) {
-        if (Test-Path -LiteralPath $p) {
-            $v = (Get-Content -LiteralPath $p -ErrorAction SilentlyContinue | Select-Object -First 1)
-            if ($v) { $script:_cachedMachineNumber = $v.Trim(); return $script:_cachedMachineNumber }
-        }
-    }
     foreach ($r in @(
         'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General',
         'HKLM:\SOFTWARE\GE Aircraft Engines\DNC\General'
     )) {
         if (Test-Path $r) {
             $p = Get-ItemProperty -Path $r -ErrorAction SilentlyContinue
-            if ($p.MachineNo) { $script:_cachedMachineNumber = [string]$p.MachineNo; return $script:_cachedMachineNumber }
+            if ($p.MachineNo) {
+                $v = ([string]$p.MachineNo).Trim()
+                if ($v) { $script:_cachedMachineNumber = $v; return $script:_cachedMachineNumber }
+            }
+        }
+    }
+    foreach ($p in @('C:\Enrollment\machine-number.txt')) {
+        if (Test-Path -LiteralPath $p) {
+            $v = (Get-Content -LiteralPath $p -ErrorAction SilentlyContinue | Select-Object -First 1)
+            if ($v) { $script:_cachedMachineNumber = $v.Trim(); return $script:_cachedMachineNumber }
         }
     }
     $script:_cachedMachineNumber = ''
@@ -575,6 +581,11 @@ foreach ($app in $config.Applications) {
 
     Write-InstallLog "==> $($app.Name)"
 
+    # Per-entry guard: a single entry that throws must NOT abort the whole
+    # scope (and silently skip every later entry + the status write). Catch,
+    # log, count as failed, move on.
+    try {
+
     if (-not (Test-PCTypeMatches -App $app -Type $PCType -SubType $PCSubType)) {
         Write-InstallLog "  PCTypes filter: entry targets $($app.PCTypes -join ',') but PC is $PCType$(if ($PCSubType) { "-$PCSubType" }) - skipping"
         $pcFiltered++
@@ -681,6 +692,11 @@ foreach ($app in $config.Applications) {
 
         $failed++
     }
+
+    } catch {
+        Write-InstallLog ("  UNCAUGHT error processing {0}: {1} | at {2}" -f $app.Name, $_.Exception.Message, ($_.ScriptStackTrace -replace '\s+',' ')) 'ERROR'
+        $failed++
+    }
 }
 
 Write-InstallLog '============================================'