CMM/DODA: restore on DODA bays + grant Full on whole C:\Apps\DODA

- Restore-CMM: drop the skip-on-doda gate. DODA bays now restore the
  config-version PC-DMIS + goCMM settings like any other bay (they have backups
  now; DODA itself installs separately to C:\Apps\DODA and is unaffected).
- sync-cmm-backups.sh: update the stale "do not back up DODA bays" note.
- Install-DODA.ps1: grant Users + Authenticated Users Full on the WHOLE
  C:\Apps\DODA (was PreProcess only) - DODA writes output/temp throughout the
  folder as the locked-down operator. /T covers PreProcess.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-cmm/Install-DODA.ps1

@@ -39,15 +39,16 @@ if (-not (Test-Path $preProcess)) {
     Write-Host "Created $preProcess"
 }
 
-# MergeFiles.exe writes into PreProcess\ at runtime AS THE LOCKED-DOWN OPERATOR,
-# not admin. Without write access the GetDoDAFolder/merge step fails. Grant
-# Users + Authenticated Users Full (object+container inherit). SIDs, not names,
-# to stay locale-independent. Applied every run so it re-asserts after any
-# lockdown pass that strips the ACE.
+# DODA runs as the LOCKED-DOWN OPERATOR (not admin) and writes throughout its
+# install folder at runtime - PreProcess\ (MergeFiles GetDoDAFolder) plus
+# output/temp elsewhere under C:\Apps\DODA. Grant Users + Authenticated Users
+# Full on the WHOLE folder (object+container inherit; /T applies it to every
+# existing child incl PreProcess). SIDs, not names, to stay locale-independent.
+# Applied every run so it re-asserts after any lockdown pass that strips the ACE.
 foreach ($sid in '*S-1-5-32-545','*S-1-5-11') {   # BUILTIN\Users, NT AUTHORITY\Authenticated Users
-    & icacls $preProcess /grant "${sid}:(OI)(CI)F" /T /C 2>&1 | Out-Null
+    & icacls $installDir /grant "${sid}:(OI)(CI)F" /T /C 2>&1 | Out-Null
 }
-Write-Host "Granted Users + Authenticated Users Full on $preProcess"
+Write-Host "Granted Users + Authenticated Users Full on $installDir (recursive)"
 
 if (Test-Path (Join-Path $installDir 'DovetailAnalysis.exe')) {
     Write-Host "DovetailAnalysis.exe verified present"