UDC firewall rules + Acrobat Reader as default PDF viewer

- Pre-create Windows Firewall inbound-allow rules for UDC.exe and
  MTConnect agent.exe before UDC_Setup.exe runs, suppressing the
  interactive "allow through firewall?" dialogs during silent install.

- Set Adobe Acrobat Reader (Acrobat.Document.DC) as the default .pdf
  handler via dism /import-defaultappassociations. Runs in
  03-ShellDefaults.ps1 so the OEMDefaultAssociations.xml is in place
  before ShopFloor's profile is created on first logon. Edge no longer
  claims .pdf on new profiles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Shopfloor/03-ShellDefaults.ps1

@@ -58,7 +58,33 @@ foreach ($p in $hklmPolicies) {
     }
 }
 
-# ---- 2. Taskbar left-align via Default User hive ----
+# ---- 2. Set Adobe Acrobat Reader as default PDF viewer ----
+# OEMDefaultAssociations.xml is read when a new user profile is created.
+# Deploying it before ShopFloor's first logon means the profile lands with
+# Acrobat as the PDF handler instead of Edge. Existing profiles (SupportUser)
+# are not affected. DISM /import-defaultappassociations writes the XML to
+# C:\Windows\System32\OEMDefaultAssociations.xml and sets the policy key.
+$assocXml = @"
+<?xml version="1.0" encoding="UTF-8"?>
+<DefaultAssociations>
+  <Association Identifier=".pdf" ProgId="Acrobat.Document.DC" ApplicationName="Adobe Acrobat" />
+</DefaultAssociations>
+"@
+$assocPath = Join-Path $env:TEMP 'DefaultAssociations.xml'
+try {
+    Set-Content -Path $assocPath -Value $assocXml -Encoding UTF8 -Force
+    $out = & dism.exe /online /import-defaultappassociations:"$assocPath" 2>&1
+    if ($LASTEXITCODE -eq 0) {
+        Write-Host "Set .pdf default to Acrobat.Document.DC via DISM"
+    } else {
+        Write-Warning "DISM import-defaultappassociations returned $LASTEXITCODE"
+    }
+    Remove-Item $assocPath -Force -ErrorAction SilentlyContinue
+} catch {
+    Write-Warning "Failed to set default PDF viewer: $_"
+}
+
+# ---- 3. Taskbar left-align via Default User hive ----
 $defaultHive = 'C:\Users\Default\NTUSER.DAT'
 $mountPoint  = 'HKU\SFLDDefault'
 $regPath     = 'Registry::HKEY_USERS\SFLDDefault\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced'