Kiosks stop installing shopfloor apps, and empty config stops meaning everything

PREINSTALL SCOPE

Sixteen entries carried PCTypes ['*'], so a Display kiosk installed Adobe
Acrobat, OpenText HostExplorer, WJF Defect Tracker, the shopfloor serial drivers
and twelve legacy VC++ redistributables. Those are now scoped to the nine
machine-tool types.

A Display now installs 3 of 21 entries:
  PowerShell 7.5.4                    SFLD-ApplyDSCConfig runs pwsh.exe 7
  VC++ Redistributable 2015-2022 x64  modern x64 runtime Edge/WebView2/PS7 lean on
  Display Kiosk App                   already Display-scoped

Kept as wildcards deliberately - removing the x64 runtime risks breaking the
kiosk itself, and PS7 is a hard dependency of the DSC task. Everything else a
kiosk has no use for. Edited as targeted text replacement, 16 line pairs, so the
file's formatting and its long _comment blocks are untouched.

THE LAST OF THE EMPTY-MEANS-DEFAULT BUGS

Configure-PC.ps1 and 07-TaskbarLayout.ps1 had the same test as the two fixed
earlier: $null -ne $cfg -AND .Count -gt 0, so an explicitly empty list fell
through to a hardcoded shopfloor default. Configure-PC is the one that actually
bit - it runs in the finalization phase and put these in the all-users Startup
folder on 579C144, timestamped mid-image:

    Defect Tracker.lnk   16:46:03
    Plant Apps.lnk       16:46:03

Plant Apps launching msedge --new-window on a kiosk. eDNC was in the same
hardcoded list and only escaped because its Test-Path guard found no DncMain.exe.

08-EdgeDefaultBrowser.ps1 had it too, with a Plant Apps + WJ Shopfloor + Dashboard
tab fallback. Harmless today because the Display profiles configure a real tab,
but one edit away from biting.

Get-ProfileValue returns $null only when a key is absent from BOTH the profile
and site-config, so $null is the only honest "not configured" signal and an
empty array means what it says.

VERIFIED against the post-fix capture: the S: mapper Run key and the machine
number prompt task are both gone, and 'ShopDB Kiosk Bootstrap' registered
correctly with boot and time triggers.

Also: the collector's StartupApproved decoder now handles 0x04/0x05, which that
same capture surfaced as unknown.

Still baked into the WIM and unaffected by any of this: WJ Shopfloor.lnk, dated
April, sitting in the all-users Startup folder.

playbook/shopfloor-setup/Shopfloor/Configure-PC.ps1

@@ -143,7 +143,21 @@ $edgePath = @(
 
 $cfgItems = Get-ProfileValue 'startupItems'
 
-if ($null -ne $cfgItems -and $cfgItems.Count -gt 0) {
+# An EMPTY configured list means "no startup items" and must be honoured.
+# Get-ProfileValue returns $null only when the key is absent from BOTH the
+# profile and site-config, so $null is the real "not configured" signal.
+#
+# The old test also required .Count -gt 0, so "startupItems": [] fell through to
+# the hardcoded list below and a Display kiosk was given UDC, eDNC, Defect
+# Tracker, WJ Shopfloor and Plant Apps startup shortcuts - Plant Apps launching
+# Edge in a new window on a kiosk. Confirmed on 579C144 2026-08-06:
+#
+#   C:\ProgramData\...\StartUp\Defect Tracker.lnk   16:46:03
+#   C:\ProgramData\...\StartUp\Plant Apps.lnk       16:46:03
+#
+# Configuring "none" produced "everything". Same bug as desktopApps in
+# 06-OrganizeDesktop.ps1 and taskbarPins in 07-TaskbarLayout.ps1.
+if ($null -ne $cfgItems) {
     $items = @()
     $num = 0
     foreach ($si in $cfgItems) {