Stage printer drivers as a deployable set, for the common scope

Assigning a printer to a bay is useless if the bay cannot install it, and the
fleet data says why that mattered: 42 of 44 printers could not resolve a driver.
This is the delivery half - the drivers themselves, staged once per bay, so that
creating a queue never waits on a download.

Install-ShopdbPrinterDriver.ps1 does one driver: trust the package's signer, then
pnputil /add-driver, then Add-PrinterDriver. Install-ShopdbPrinterDrivers.ps1
does a site's whole set from drivers.json, and answers a compliance question with
-TestOnly, which is what makes it a clean DSC Script resource rather than a
fire-and-forget install.

Deliberately SEPARATE from assignment. Drivers are large, near-identical across a
fleet and change rarely; assignments are small, per-bay and change often. Staging
the set in the GE-Enforce common scope means the assignment client only ever
creates a queue - it never fetches a 48 MB package while somebody is waiting to
print, or discovers the share is unmounted at the worst moment.

THE SIGNER TRUST STEP IS THE WHOLE TRICK, and it took a real driver to find it.
certutil -addstore on the .cat file satisfied the Xerox package and failed every
HP INF with "The publisher of an Authenticode(tm) signed catalog has not yet been
established as trusted" - a coin toss, not a mechanism. The certificate is now
extracted with Get-AuthenticodeSignature and added to Trusted Publishers, for
every catalog under the package rather than the first INF's neighbours. On a
locked bay there is no prompt to answer, so the old failure was silent.

Verified on Windows against real packages, not by reading: all six drivers this
site needs install through the script, a second run is a no-op, a wrong driver
name fails with the names the package actually offers, and the DSC cycle behaves
- TestOnly exits 1 on a clean box, install exits 0, TestOnly then exits 0.

The packages themselves stay out of git: they are licensed vendor binaries, and
they belong on the share beside the other imaging payloads.

DEPLOYING-DRIVERS.md carries the GE-Enforce entry, the DSC configuration and the
Intune shape, plus the constraint that has cost a session before: the SFLD share
is mounted only during the enforcement cycle, so this runs as a manifest entry
and never as its own scheduled task.

plugins/printers/client/drivers.example.json

@@ -0,0 +1,35 @@
+{
+  "_comment": "Driver set for a site. Each entry names a driver EXACTLY as its INF declares it (what Add-PrinterDriver matches on) and where its package lives, relative to the package root or as an absolute UNC path. Copy to drivers.json and edit for the site.",
+  "drivers": [
+    {
+      "drivername": "HP Universal Printing PS",
+      "path": "drivers/hp_upd_ps",
+      "covers": "HP office printers (universal)"
+    },
+    {
+      "drivername": "Xerox Global Print Driver PCL6",
+      "path": "drivers/xerox_gpd",
+      "covers": "Xerox office printers (universal)"
+    },
+    {
+      "drivername": "HP DesignJet T1700dr V4",
+      "path": "drivers/hp_designjet",
+      "covers": "DesignJet T1700 / T1700dr plotters"
+    },
+    {
+      "drivername": "ZDesigner ZT411-300dpi ZPL",
+      "path": "drivers/zebra_zt411",
+      "covers": "Zebra ZT411 label printers"
+    },
+    {
+      "drivername": "EPSON TM-C3500",
+      "path": "drivers/epson_tmc3500",
+      "covers": "Epson ColorWorks C3500 label printers"
+    },
+    {
+      "drivername": "DTC4500e Card Printer",
+      "path": "drivers/hid_dtc4500e",
+      "covers": "HID FARGO DTC4500e card printer"
+    }
+  ]
+}