shopfloor: CMM PC-DMIS version gate, ShopDB reporter fixes, staging self-heal

- lib Install-FromManifest 2.5->2.6: add _CmmVersion per-entry filter (reads
  C:\Enrollment\cmm\version.txt). Lifted the version gate out of 09-Setup-CMM
  into the shared lib so imaging and GE-Enforce apply it identically and cannot
  drift (root cause of PC-DMIS 2016 installing on every CMM).
- Install-goCMMSettings: canonicalize the part-group share host to the FQDN in
  both the registry and ApplicationSettings.xml. Handles bare \\tsgwp00525\ and
  the legacy rd.ds.ge.com domain; idempotent. VM-tested.
- Report-AssetToShopDB: resolve the machine number eDNC registry first, then fall
  back to C:\Enrollment\machine-number.txt (matches the lib resolution order) so
  a freshly imaged PC still reports its number for the PC-machine relationship.
- Add Update-CMMEnforcer.ps1/.bat: update one CMM's local lib to the gated
  version and self-heal its PC-DMIS version.
- Add Debug-ShopDBReporting.ps1/.bat: one-shot reporter triage (preconditions,
  client log, live test POST, verdict).
- Add Verify-And-Heal-Staging.ps1/.bat: post-boot check that every imaging
  payload arrived and re-pull anything missing from the share, including the CMM
  bundle and the selected bay's backup (the payload that times out in WinPE).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-cmm/09-Setup-CMM.ps1

@@ -124,42 +124,13 @@ else {
     if (Test-Path 'C:\Enrollment\pc-type.txt')    { $pcType    = (Get-Content 'C:\Enrollment\pc-type.txt'    -First 1 -EA 0).Trim() }
     if (Test-Path 'C:\Enrollment\pc-subtype.txt') { $pcSubType = (Get-Content 'C:\Enrollment\pc-subtype.txt' -First 1 -EA 0).Trim() }
 
-    # Read resolved PC-DMIS version from bay-config (written by
-    # resolve-cmm-bay-config.ps1 via startnet.cmd). If missing, install all
-    # PC-DMIS versions (legacy behavior for bays imaged before the picker).
-    $cmmVersion = ''
-    $cmmVersionFile = 'C:\Enrollment\cmm\version.txt'
-    if (Test-Path -LiteralPath $cmmVersionFile) {
-        $cmmVersion = (Get-Content -LiteralPath $cmmVersionFile -First 1 -EA 0).Trim()
-    }
-    Write-CMMLog "Resolved CMM version: $(if ($cmmVersion) { $cmmVersion } else { '(none - installing all)' })"
-
-    # Filter manifest: drop entries whose _CmmVersion doesn't match the
-    # resolved version. Entries without _CmmVersion always pass (CLM, goCMM,
-    # Protect Viewer, DODA). Write a temp filtered manifest for the lib.
-    if ($cmmVersion) {
-        try {
-            $cfg = Get-Content $stagingMani -Raw | ConvertFrom-Json
-            $filtered = @($cfg.Applications | Where-Object {
-                if (-not $_._CmmVersion) { return $true }
-                return ($_._CmmVersion -ieq $cmmVersion)
-            })
-            $skipped = @($cfg.Applications | Where-Object {
-                $_._CmmVersion -and ($_._CmmVersion -ine $cmmVersion)
-            })
-            foreach ($s in $skipped) {
-                Write-CMMLog "  Skipping $($s.Name) (_CmmVersion=$($_._CmmVersion) != $cmmVersion)"
-            }
-            $cfg.Applications = $filtered
-            $filteredMani = Join-Path $stagingRoot 'cmm-manifest-filtered.json'
-            $cfg | ConvertTo-Json -Depth 10 | Set-Content -LiteralPath $filteredMani -Encoding UTF8
-            Write-CMMLog "Filtered manifest: $($filtered.Count) entries (from $($filtered.Count + $skipped.Count))"
-            $stagingMani = $filteredMani
-        } catch {
-            Write-CMMLog "Version filter failed: $_ - using unfiltered manifest" 'WARN'
-        }
-    }
-
+    # PC-DMIS version gating (drop entries whose _CmmVersion does not match the
+    # bay's C:\Enrollment\cmm\version.txt) is now owned by the shared lib
+    # Install-FromManifest.ps1 (>= 2.6). Both this imaging path and the runtime
+    # GE-Enforce path call that lib, so the gate is applied identically in one
+    # place and the two paths cannot drift. We pass the full manifest unfiltered
+    # and let the lib filter per entry. The bug this prevents: enforce lacked
+    # the gate and reinstalled the wrong PC-DMIS version on an already-imaged bay.
     Write-CMMLog "Running Install-FromManifest against $stagingRoot (PCType=$pcType, PCSubType=$pcSubType)"
     & $libSource -ManifestPath $stagingMani -InstallerRoot $stagingRoot -LogFile $logFile -PCType $pcType -PCSubType $pcSubType
     $rc = $LASTEXITCODE