CMM/DODA: restore on DODA bays + grant Full on whole C:\Apps\DODA

- Restore-CMM: drop the skip-on-doda gate. DODA bays now restore the
  config-version PC-DMIS + goCMM settings like any other bay (they have backups
  now; DODA itself installs separately to C:\Apps\DODA and is unaffected).
- sync-cmm-backups.sh: update the stale "do not back up DODA bays" note.
- Install-DODA.ps1: grant Users + Authenticated Users Full on the WHOLE
  C:\Apps\DODA (was PreProcess only) - DODA writes output/temp throughout the
  folder as the locked-down operator. /T covers PreProcess.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-cmm/scripts/Restore-CMM.ps1

@@ -11,8 +11,10 @@ resolve-cmm-bay-config.ps1 at the WinPE picker):
                   version it ever had (2016.0 + 2019 R2); we restore ONLY the
                   one the bay-config pins, matched by substring (2019 -> the
                   '2019 R2' zip, 2016 -> the '2016.0' zip).
-  doda.txt      - 'no' to proceed; anything else SKIPS restore (DODA bays are
-                  handled separately and must not get a settings overlay).
+  doda.txt      - read for logging only. DODA bays now restore like any other:
+                  once they are properly backed up + staged, the config-version
+                  zip is restored the same way. (The old skip-on-doda policy was
+                  dropped 2026-06-17; DODA bays had no backups when it was added.)
   partgroup.txt - optional goCMM Selected Part Group (friendly S:\ form), used
                   as the authoritative per-bay override even if the backup is stale.
 
@@ -50,7 +52,9 @@ $doda  = (ReadTxt 'doda.txt').ToLower()
 $pgRaw = ReadTxt 'partgroup.txt'
 
 if (-not $cmmid) { Log "no cmmid.txt (manual CMM id, or not a bay-config bay) - nothing to restore. Skipping."; exit 0 }
-if ($doda -eq 'yes') { Log "DODA bay ($cmmid) - skipping settings restore by policy."; exit 0 }
+# DODA bays restore like any other now (skip-on-doda dropped 2026-06-17). DODA
+# itself installs separately via the manifest to C:\Apps\DODA - independent of
+# the goCMM (C:\geaofi) + PC-DMIS settings this restore lays back.
 
 $bdir = Join-Path $BackupRoot $cmmid
 if (-not (Test-Path -LiteralPath $bdir)) { Log "no staged backup at $bdir - skipping (stage it with sync-cmm-backups.sh)."; exit 0 }