CMM: add goCMM settings backup/restore + debug scripts

goCMM settings live in two places: 3 pointer values at
HKLM\SOFTWARE\WOW6432Node\General Electric\goCMM, and the real content of all
7 Settings tabs (PC-DMIS, Quindos, Modus, Machine Definition, User Input,
Notifications, Part Groups) in C:\geaofi\ApplicationSettings.xml. Capture-replay
pair, mirroring the Wax/Trace Backup/Install scripts:

- Backup-goCMMSettings.ps1/.bat: on a live legacy bay (admin), zips the registry
  key + the C:\geaofi tree (minus transient LocalProgramCopies/logs) to
  gocmm_backup_<PC>_<ts>.zip.
- Install-goCMMSettings.ps1/.bat: restore at imaging (admin). Imports the key +
  lays down C:\geaofi, then grants BUILTIN\Users WriteKey on the reg key and
  Modify on C:\geaofi - goCMM's RegistrySettings.GetRegistryString opens the key
  with writable:true even to READ, so a locked-down operator throws a
  SecurityException without the grant (the post-lockdown 'registry access not
  allowed' error). Applies a built-in legacy->new FQDN rewrite
  (rd.ds.ge.com -> wjs.geaerospace.net) automatically across the registry values
  and ApplicationSettings.xml (incl PartGroup FullName); -NoDefaultRewrite skips
  it, /replace adds an extra pair, -SelectedPartGroup overrides per bay.
- gocmm-debug.ps1/.bat: run as the operator to reproduce the SecurityException
  and dump the goCMM key ACL (confirms whether lockdown stripped the grant).

All round-trip + FQDN-rewrite verified on the win11 VM. NOTE: covers goCMM only;
PC-DMIS probe calibrations / custom tip angles / machine comp are owned by
PC-DMIS (Hexagon) and not captured here. Not yet wired into 09-Setup-CMM
auto-discovery.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-cmm/scripts/gocmm-debug.bat

@@ -0,0 +1,25 @@
+@echo off
+REM gocmm-debug.bat - launcher for gocmm-debug.ps1
+REM
+REM   *** RUN THIS AS THE OPERATOR (the locked-down shop-floor user). ***
+REM   *** DO NOT right-click "Run as administrator" - that hides the bug. ***
+REM
+REM Reproduces the goCMM "Requested registry access is not allowed" error and
+REM dumps the goCMM registry key's ACL so we can confirm the lockdown stripped
+REM the BUILTIN\Users write grant. Output lands in C:\Logs\CMM\.
+
+setlocal
+set "HERE=%~dp0"
+
+echo.
+echo Running goCMM debug as %USERDOMAIN%\%USERNAME% ...
+echo (If you see "Administrator: ..." in this window title, STOP - run as the operator instead.)
+echo.
+
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%HERE%gocmm-debug.ps1"
+
+echo.
+echo ---------------------------------------------------------------
+echo Done. Collect everything under C:\Logs\CMM\ (the .txt and .reg).
+echo ---------------------------------------------------------------
+pause