Identify a marker by its device, without moving what NTLARS reports

A part marker has no machine number of its own - the device is what a backup
belongs to, and C:\Enrollment\asset-id.txt is what names it. Reading that file
inside the shared machine-number lookup looked like the tidy place for it and
was wrong: marker bays run eDNC too, so Backup-NtlarsSettings.ps1 reaches the
same lookup, and it would have started posting a machine's DNC settings under
the marker's asset number where today it exits quietly. The marker script asks
for the fallback explicitly instead, which is what -MachineNumberFallback is
for.

Also from review:

Returning a byte array bare lets the pipeline enumerate it, so an EMPTY file
came back as $null, ComputeHash threw, and with ErrorActionPreference=Continue
the manifest entry silently kept the previous file's hash - a corrupted
manifest stored as a good revision. Empty parameter files are plausible.

Reading registry values directly under StrictMode throws when one is absent, so
the "no Port Id" guard was unreachable and a partially configured marker bay
reported itself as having no marker at all, permanently and quietly. Values are
now read through a presence check with the fleet's own defaults.

The outside-window quiet state embedded the hour, so the say-once module said
it hourly. Command replies now have their checksum verified like data blocks
do, since a corrupted listing entry would otherwise be trusted and a file
requested under a name the controller does not have. A controller that
genuinely holds nothing is no longer reported as a failed capture. A snapshot
that could not be written to the share now counts as a missed backup like the
rest, and the header no longer claims orphaned snapshots get tidied - they are
kept on purpose, because a timed-out post may still have been recorded.

playbook/shopfloor-setup/common/lib/ShopdbBackupClient.psm1

@@ -46,6 +46,16 @@ $script:LOGDIR    = 'C:\Logs\Shopfloor'
 $script:SHOPDBREG = 'HKLM:\SOFTWARE\GE\ShopDB'
 $script:KEYFILE   = 'C:\Enrollment\shopdb-key.txt'
 $script:PCCONFIG  = 'C:\Enrollment\pc-config.txt'
+# The DEVICE this PC drives, by asset number - a part marker, a CMM, a Keyence.
+# Written at staging and read by the computers collector, which resolves it with
+# _asset_by_number and refuses a name it cannot find rather than minting a
+# phantom. Marker and measuring-tool bays have no machine number of their own
+# ("keyence / genspect / part-marker have no per-bay id" in
+# Report-AssetToShopDB.ps1), so for those this file IS the identity.
+$script:ASSETIDFILE = 'C:\Enrollment\asset-id.txt'
+# 0.12.0 shipped this name before the file was generalised; a bay staged then
+# still has it.
+$script:LEGACYASSETIDFILE = 'C:\Enrollment\measuringtool-id.txt'
 
 # The action ShopDB reported for the most recent post, per kind: 'created',
 # 'noop', or '' when nothing has been posted. Send-ShopdbBackup returns only
@@ -144,6 +154,26 @@ function Get-ShopdbCollectorKey {
 }
 
 
+function Get-ShopdbAssetId {
+    <#
+        The asset number of the device this PC drives, or ''.
+
+        Same file and same precedence the computers collector uses, so a bay
+        cannot report its marker under one identity and its backup under
+        another.
+    #>
+    foreach ($file in @($script:ASSETIDFILE, $script:LEGACYASSETIDFILE)) {
+        if (Test-Path $file) {
+            try {
+                $value = ([string](Get-Content -LiteralPath $file -First 1 -EA Stop)).Trim()
+                if ($value) { return $value }
+            } catch { }
+        }
+    }
+    return ''
+}
+
+
 function Get-ShopdbMachineNumber {
     <#
         The machine number this PC reports, from pc-config.txt.
@@ -168,6 +198,19 @@ function Get-ShopdbMachineNumber {
             if ($val) { return ([string]$val).Trim() }
         } catch { }
     }
+
+    # NO asset-id.txt fallback here, deliberately. It belongs to the CALLER.
+    #
+    # A part-marker bay has no machine number of its own but does have the DNC
+    # registry tree, so Backup-NtlarsSettings.ps1 passes its key check and
+    # reaches this function. A shared fallback would make it post the machine's
+    # DNC settings under the MARKER's asset number - a kind that resolves by
+    # machine number, handed a device asset number - where today it exits
+    # quietly. That is a behaviour change to a script running in production.
+    #
+    # A kind that legitimately identifies itself by device passes
+    # -MachineNumberFallback { Get-ShopdbAssetId } instead. The per-kind
+    # mechanism already exists; this is what it is for.
     return ''
 }
 
@@ -479,4 +522,5 @@ Export-ModuleMember -Function Initialize-ShopdbBackup, Send-ShopdbBackup,
     Get-ShopdbRegValue, Get-ShopdbCollectorKey, Get-ShopdbMachineNumber,
     Get-ShopdbIntervalHours, Get-ShopdbLogPath,
     Get-ShopdbLastBackupAction, Test-ShopdbBackupNoop,
-    Add-ShopdbBackupSkip, Get-ShopdbBackupSkips, Clear-ShopdbBackupSkips
+    Add-ShopdbBackupSkip, Get-ShopdbBackupSkips, Clear-ShopdbBackupSkips,
+    Get-ShopdbAssetId