UDC firewall rules + Acrobat Reader as default PDF viewer

- Pre-create Windows Firewall inbound-allow rules for UDC.exe and
  MTConnect agent.exe before UDC_Setup.exe runs, suppressing the
  interactive "allow through firewall?" dialogs during silent install.

- Set Adobe Acrobat Reader (Acrobat.Document.DC) as the default .pdf
  handler via dism /import-defaultappassociations. Runs in
  03-ShellDefaults.ps1 so the OEMDefaultAssociations.xml is in place
  before ShopFloor's profile is created on first logon. Edge no longer
  claims .pdf on new profiles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/00-PreInstall-MachineApps.ps1

@@ -180,6 +180,25 @@ if ($machineNum -and $machineNum -ne '9999') {
     }
 }
 
+# --- Pre-create Windows Firewall rules for UDC + MTConnect Agent so the
+#     installer doesn't pop firewall-allow dialogs during silent install.
+#     Rules are idempotent (New-NetFirewallRule -ErrorAction SilentlyContinue
+#     on existing rule name is a no-op in practice; we remove-then-add).
+$fwRules = @(
+    @{ Name = 'UDC';              Program = 'C:\Program Files\UDC\UDC.exe' },
+    @{ Name = 'UDC MTConnect Agent'; Program = 'C:\ProgramData\UDC\MTConnect_UDC\Agent\agent.exe' }
+)
+foreach ($r in $fwRules) {
+    try {
+        Remove-NetFirewallRule -DisplayName $r.Name -ErrorAction SilentlyContinue
+        New-NetFirewallRule -DisplayName $r.Name -Direction Inbound -Program $r.Program `
+            -Action Allow -Profile Any -ErrorAction Stop | Out-Null
+        Write-PreInstallLog "Firewall rule created: $($r.Name) -> $($r.Program)"
+    } catch {
+        Write-PreInstallLog "Firewall rule '$($r.Name)' failed: $_" "WARN"
+    }
+}
+
 # --- Detection helper (mirrors Simple-Install.ps1's Test-ApplicationInstalled) ---
 function Test-AppInstalled {
     param($App)