run-enrollment: wait for PPKG provisioning before staging chain

Install-ProvisioningPackage is async — it queues the provisioning engine
and returns immediately. The actual BPRT app installs (Chrome, Office,
Tanium, CyberArk, etc.) run in the background. Without waiting, the
PPKG reboot fires while installs are still in progress, leaving apps
partially installed.

Fix: poll for C:\Logs\BPRT\Remove Staging Locations\Log.txt — the last
BPRT step. When that file exists, all provisioning steps have completed.
Polls every 10 seconds for up to 15 minutes (Office install can be slow).
Progress logged every 30 seconds showing which steps have finished.

If the timeout fires (15 min), logs a warning and proceeds — the SYSTEM
logon task from 06-OrganizeDesktop.ps1 provides self-healing on the next
boot for anything that was incomplete.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/run-enrollment.ps1

@@ -47,6 +47,41 @@ try {
     }
 }
 
+# --- Wait for PPKG provisioning to finish ---
+# Install-ProvisioningPackage is async — it queues the provisioning engine
+# and returns immediately. The actual app installs (Chrome, Office, Tanium,
+# CyberArk, etc.) run in the background as BPRT steps. Each step writes a
+# Log.txt under C:\Logs\BPRT\<step name>\. "Remove Staging Locations" is
+# the LAST step — when its Log.txt exists, all provisioning is done.
+# We poll for that marker before writing the stage file, so the PPKG reboot
+# doesn't fire while installs are still in progress.
+$bprtMarker = 'C:\Logs\BPRT\Remove Staging Locations\Log.txt'
+$maxWait = 900   # 15 minutes (Office install can be slow)
+$pollInterval = 10
+$elapsed = 0
+
+Log "Waiting for PPKG provisioning to complete (polling for $bprtMarker)..."
+while (-not (Test-Path -LiteralPath $bprtMarker) -and $elapsed -lt $maxWait) {
+    Start-Sleep -Seconds $pollInterval
+    $elapsed += $pollInterval
+    # Show progress every 30 seconds
+    if ($elapsed % 30 -eq 0) {
+        $completedSteps = @(Get-ChildItem 'C:\Logs\BPRT' -Directory -ErrorAction SilentlyContinue |
+            Where-Object { Test-Path (Join-Path $_.FullName 'Log.txt') } |
+            Select-Object -ExpandProperty Name)
+        Log "  $elapsed s elapsed, $($completedSteps.Count) BPRT steps done: $($completedSteps -join ', ')"
+    }
+}
+
+if (Test-Path -LiteralPath $bprtMarker) {
+    Log "PPKG provisioning complete after $elapsed s."
+    $allSteps = @(Get-ChildItem 'C:\Logs\BPRT' -Directory -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Name)
+    Log "  Completed steps: $($allSteps -join ', ')"
+} else {
+    Log "WARNING: PPKG provisioning timeout after $maxWait s — some apps may not be installed."
+    Log "  Proceeding anyway. The SYSTEM logon task will retry incomplete items on next boot."
+}
+
 # --- Set OOBE complete ---
 Log "Setting OOBE as complete..."
 reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\OOBE" /v OOBEComplete /t REG_DWORD /d 1 /f | Out-Null