CMM/DODA: restore on DODA bays + grant Full on whole C:\Apps\DODA

- Restore-CMM: drop the skip-on-doda gate. DODA bays now restore the
  config-version PC-DMIS + goCMM settings like any other bay (they have backups
  now; DODA itself installs separately to C:\Apps\DODA and is unaffected).
- sync-cmm-backups.sh: update the stale "do not back up DODA bays" note.
- Install-DODA.ps1: grant Users + Authenticated Users Full on the WHOLE
  C:\Apps\DODA (was PreProcess only) - DODA writes output/temp throughout the
  folder as the locked-down operator. /T covers PreProcess.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/sync-cmm-backups.sh

@@ -13,8 +13,8 @@
 # Pushes the NEWEST backup set per cmm_id to:
 #   /srv/samba/enrollment/installers-post/cmm/backups/<cmm_id>/
 #
-# DODA bays: do NOT back them up (don't put them under cmm-bk/). 09-Setup-CMM
-# also gates restore on cmm-bay-config doda=no as a second guard.
+# DODA bays ARE backed up + restored like any other now (the old skip-on-doda
+# policy in Restore-CMM was dropped 2026-06-17). Stage them here the same way.
 #
 # Usage:  ./playbook/sync-cmm-backups.sh           (all cmm_id folders)
 #         CMM_ID=CMM3 ./playbook/sync-cmm-backups.sh   (just one)