Shopfloor self-heal: bootstrap recovery scripts + Keyence/WaxTrace heal

Fixes Keyence (and CMM/WaxTrace) imaging where the target got only partial
data: the Y: SMB mount goes idle-dead during WIM apply, so WinPE staging dies
early (often just after site-config.json + ppkg). The first-logon self-heal
was meant to recover but its scripts were themselves staged past the death
point, so nothing ran.

- FlatUnattendW10-shopfloor.xml: new FirstLogonCommands Order-4 bootstrap that
  mounts the enrollment share fresh and pulls Fetch-StagingPayload /
  Verify-And-Heal-Staging / enrollment scripts into C:\Enrollment before the
  Order 5/6 heal runs. Recovery no longer depends on WinPE staging surviving.
  Keep CommandLine <=320 and Description <=252 chars: exceeding the unattend
  schema length limits makes the whole oobeSystem pass invalid (OOBE prompts,
  no autologon).

- Verify-And-Heal-Staging.ps1: add Keyence and WaxTrace heavy-payload heal
  branches (previously only CMM). Keyence re-pulls installers-post\keyence\
  <model> -> C:\KeyenceInstall\<model>; WaxTrace re-pulls the bundle (minus
  formtracepak) plus the bay-matched FORMTRACEPAK-V<ver>.iso.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

playbook/shopfloor-setup/Verify-And-Heal-Staging.ps1

@@ -7,10 +7,12 @@ enrollment share. Runs in full Windows (reliable network), so it is immune to th
 WinPE samba-idle-drop that loses copies during the WIM apply.
 
 Covers the generic Fetch payload (shopfloor-setup tree + preinstall bundle) AND
-the heavy per-type payload that Fetch-StagingPayload does NOT pull today: the CMM
-bundle (C:\CMM-Install) and the selected bay's backup set
-(C:\CMM-Install\backups\<cmmid>). That is the one that silently goes missing when
-WinPE staging runs out of time before reboot.
+the heavy per-type payloads that Fetch-StagingPayload does NOT pull today:
+  - CMM      C:\CMM-Install (+ selected bay's backup C:\CMM-Install\backups\<cmmid>)
+  - Keyence  C:\KeyenceInstall\<model> (MSI + Data*.cab)
+  - WaxTrace C:\WaxTrace-Install (bundle + bay-matched FormTracePak ISO)
+These are the ones that silently go missing when WinPE staging runs out of time
+(idle-dead Y: mount) before reboot.
 
 Designed to be:
   - run manually on a problem PC (Verify-And-Heal-Staging.bat), or
@@ -89,6 +91,31 @@ if ($pcType -eq 'gea-shopfloor-cmm') {
         Add-Item "CMM backup ($cmmid)" "installers-post\cmm\backups\$cmmid" "C:\CMM-Install\backups\$cmmid" 'Dir' "C:\CMM-Install\backups\$cmmid" $null $true
     }
 }
+# --- heavy Keyence payload (same gap as CMM: WinPE-only staged, never re-pulled
+# by Fetch-StagingPayload). Only the selected model bundle lands under
+# C:\KeyenceInstall\<model>. Verify on the model manifest so a missing/partial
+# Data1.cab (the 700 MB - 2 GB payload msiexec SECREPAIR-hashes) gets re-pulled. ---
+if ($pcType -eq 'gea-shopfloor-keyence') {
+    $kmodel = ReadTxt 'C:\Enrollment\keyence-model.txt'
+    if (-not $kmodel) { $kmodel = 'vr6000' }
+    Add-Item "Keyence bundle ($kmodel)" "installers-post\keyence\$kmodel" "C:\KeyenceInstall\$kmodel" 'Dir' "C:\KeyenceInstall\$kmodel\manifest.json"
+}
+# --- heavy WaxTrace payload (same gap as CMM/Keyence). Two parts, mirroring the
+# three-step WinPE stage: (1) the bundle minus the formtracepak\ ISO dir, and
+# (2) ONLY the bay's matched FORMTRACEPAK-V<ver>.iso, keyed on the version
+# resolve-bay-config wrote to C:\Enrollment\waxtrace\version.txt during WinPE.
+# If version.txt is missing (mount died before the resolver ran) the ISO cannot
+# be re-pulled here - the bundle+resolver still heal, and resolve-bay-config can
+# be re-run manually to regenerate version.txt then re-run this heal. ---
+if ($pcType -eq 'gea-shopfloor-waxtrace') {
+    Add-Item 'WaxTrace bundle' 'installers-post\waxtrace' 'C:\WaxTrace-Install' 'Dir' 'C:\WaxTrace-Install\waxtrace-manifest.json' $null $false 'formtracepak'
+    $wtver = ReadTxt 'C:\Enrollment\waxtrace\version.txt'
+    if ($wtver) {
+        Add-Item "WaxTrace FTPak V$wtver" 'installers-post\waxtrace\formtracepak' 'C:\WaxTrace-Install\formtracepak' 'File' "C:\WaxTrace-Install\formtracepak\FORMTRACEPAK-V$wtver.iso" @("FORMTRACEPAK-V$wtver.iso")
+    } else {
+        Log 'WaxTrace: version.txt absent - cannot heal the bay-specific FormTracePak ISO (re-run resolve-bay-config then re-run heal)' 'WARN'
+    }
+}
 
 # --- robocopy-based verify/heal -----------------------------------------------
 # Presence alone is NOT trusted: a partially transferred file (e.g. a truncated