notifications: let Recognition set start/end dates; geenforce B2 client payload fetch

Recognition edit hid the time fields (grouped with Recertification), so start/end
could not be adjusted even though the backend honors them. Show the time fields
for every type except Recertification (due-date driven); Recognition end still
auto-fills to the next 8 AM reset when blank.

Also GE-Enforce B2 client (HTTPS payload consume): ShopdbEnforceClient.psm1 gains
Get-ShopdbPayload (fetch by sha256, verify, cache) + Resolve-ShopdbPayloads
(rewrite http/inline entries to local staged files so the engine installs from
local, no SMB); Invoke-ShopdbEnforce resolves payloads before running the engine;
importer parses PayloadSource/PayloadSha256/PayloadRef. VM-verified: a SYSTEM
Windows client fetched a payload over HTTP by hash, hash matched.

plugins/geenforce/client/Invoke-ShopdbEnforce.ps1

@@ -74,7 +74,18 @@ try {
     }
 
     # Which manifest the engine actually runs against.
-    $manifestToRun = if ($ShadowMode -and $ShareManifestPath) { $ShareManifestPath } else { $sync.Path }
+    if ($ShadowMode -and $ShareManifestPath) {
+        # Shadow: install from the share exactly as today (no payload resolve).
+        $manifestToRun = $ShareManifestPath
+    } else {
+        # Cutover: stage any http/inline payloads to local files and rewrite the
+        # manifest to point at them, so the UNCHANGED engine installs from local
+        # (no SMB needed for share-less PCs).
+        $manifestToRun = Resolve-ShopdbPayloads -ManifestPath $sync.Path -Config $config
+        if ($manifestToRun -ne $sync.Path) {
+            Write-Log "Resolved http/inline payloads to local files: $manifestToRun"
+        }
+    }
 
     # --- INTEGRATION POINT ---------------------------------------------------
     # Run the engine. Install-FromManifest.ps1 is expected to return (or you