shopfloor: CMM PC-DMIS version gate, ShopDB reporter fixes, staging self-heal

- lib Install-FromManifest 2.5->2.6: add _CmmVersion per-entry filter (reads
  C:\Enrollment\cmm\version.txt). Lifted the version gate out of 09-Setup-CMM
  into the shared lib so imaging and GE-Enforce apply it identically and cannot
  drift (root cause of PC-DMIS 2016 installing on every CMM).
- Install-goCMMSettings: canonicalize the part-group share host to the FQDN in
  both the registry and ApplicationSettings.xml. Handles bare \\tsgwp00525\ and
  the legacy rd.ds.ge.com domain; idempotent. VM-tested.
- Report-AssetToShopDB: resolve the machine number eDNC registry first, then fall
  back to C:\Enrollment\machine-number.txt (matches the lib resolution order) so
  a freshly imaged PC still reports its number for the PC-machine relationship.
- Add Update-CMMEnforcer.ps1/.bat: update one CMM's local lib to the gated
  version and self-heal its PC-DMIS version.
- Add Debug-ShopDBReporting.ps1/.bat: one-shot reporter triage (preconditions,
  client log, live test POST, verdict).
- Add Verify-And-Heal-Staging.ps1/.bat: post-boot check that every imaging
  payload arrived and re-pull anything missing from the share, including the CMM
  bundle and the selected bay's backup (the payload that times out in WinPE).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/gea-shopfloor-collections/Report-AssetToShopDB.ps1

@@ -83,16 +83,38 @@ if (-not $serialNumber) {
     exit 0
 }
 
-# DNC machine number from eDNC reg (2001, 2002, ...). optional - sent only if present.
+# DNC machine number (2001, 2002, ...). optional - sent only if found.
+# Resolution order mirrors the GE-Enforce lib Get-CurrentMachineNumber so the
+# reporter and manifest gating agree:
+#   1. eDNC registry (WOW6432Node, then native) - follows bay reassignment, which
+#      Set-MachineNumber rewrites here.
+#   2. C:\Enrollment\machine-number.txt - the imaging-time value written once by
+#      startnet.cmd. Used when eDNC has not populated the registry yet (fresh
+#      image, or a bay where eDNC has not run), so the PC still reports its number
+#      and api.asp can build the relationship.
 $machineNo = ''
-$edncRegPath = 'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General'
-try {
-    if (Test-Path $edncRegPath) {
-        $machineNo = [string](Get-ItemProperty -Path $edncRegPath -Name MachineNo -ErrorAction Stop).MachineNo
-        $machineNo = $machineNo.Trim()
+foreach ($regPath in @(
+    'HKLM:\SOFTWARE\WOW6432Node\GE Aircraft Engines\DNC\General',
+    'HKLM:\SOFTWARE\GE Aircraft Engines\DNC\General'
+)) {
+    if ($machineNo) { break }
+    try {
+        if (Test-Path $regPath) {
+            $v = [string](Get-ItemProperty -Path $regPath -Name MachineNo -ErrorAction Stop).MachineNo
+            if ($v) { $machineNo = $v.Trim() }
+        }
+    } catch {
+        Log "WARN could not read MachineNo from ${regPath}: $($_.Exception.Message)"
+    }
+}
+if (-not $machineNo) {
+    $mnFile = 'C:\Enrollment\machine-number.txt'
+    if (Test-Path -LiteralPath $mnFile) {
+        try {
+            $v = Get-Content -LiteralPath $mnFile -First 1 -ErrorAction Stop
+            if ($v) { $machineNo = ([string]$v).Trim(); Log "machineNo from $mnFile (eDNC registry empty): $machineNo" }
+        } catch { Log "WARN could not read ${mnFile}: $($_.Exception.Message)" }
     }
-} catch {
-    Log "WARN could not read eDNC MachineNo: $($_.Exception.Message)"
 }
 
 # OS caption for the operatingsystems lookup.