geenforce: fix http-payload path doubling + sweep stale kiosk startup shortcuts

- Resolve-ShopdbPayloads wrote an absolute local path into the entry, and the
  engine resolves it as Join-Path InstallerRoot <field>, doubling it
  (C:\...\payloads\C:\...\payloads\<sha>.ps1 -> PS1 not found). Write the leaf
  filename instead; the runner already sets InstallerRoot to that payloads dir.
- display dispatcher now removes leftover kiosk launchers from prior installs
  (any Startup .lnk that runs Edge --kiosk, plus .url to a shopdb kiosk page),
  not just its own, so two kiosks do not fight.

plugins/geenforce/client/ShopdbEnforceClient.psm1

@@ -313,8 +313,13 @@ function Resolve-ShopdbPayloads {
         $ref = Get-ShopdbProperty $entry 'PayloadRef'
         $local = Get-ShopdbPayload -Sha256 $sha -Config $Config -Filename $ref -CacheDir $CacheDir
         if (-not $local) { throw "payload $sha for '$($entry.Name)' could not be fetched/verified" }
-        if ($entry.PSObject.Properties.Name -contains $field) { $entry.$field = $local }
-        else { $entry | Add-Member -NotePropertyName $field -NotePropertyValue $local }
+        # Write the LEAF filename, not the absolute path: the engine resolves the
+        # entry field as Join-Path $InstallerRoot <field>, and the runner sets
+        # InstallerRoot to this same payloads dir. Passing an absolute path made
+        # the engine double it (InstallerRoot + C:\...\ -> C:\...\C:\...).
+        $leaf = Split-Path -Leaf $local
+        if ($entry.PSObject.Properties.Name -contains $field) { $entry.$field = $leaf }
+        else { $entry | Add-Member -NotePropertyName $field -NotePropertyValue $leaf }
         $changed = $true
     }
     if (-not $changed) { return $ManifestPath }

plugins/geenforce/seed_display_scope.py

@@ -144,13 +144,34 @@ if (-not $edge) {{ Write-Host 'msedge.exe not found; cannot write kiosk startup
 
 $startup = Join-Path $env:ProgramData 'Microsoft\\Windows\\Start Menu\\Programs\\Startup'
 if (-not (Test-Path $startup)) {{ New-Item -ItemType Directory -Path $startup -Force | Out-Null }}
-# Clear any prior ShopDB kiosk shortcut so a URL/type change self-heals.
-Get-ChildItem -LiteralPath $startup -Filter 'ShopDB Kiosk*.lnk' -ErrorAction SilentlyContinue |
-    ForEach-Object {{ Remove-Item -LiteralPath $_.FullName -Force -ErrorAction SilentlyContinue }}
+$shell = New-Object -ComObject WScript.Shell
+
+# Clear leftover kiosk launchers from THIS or PRIOR installs so two kiosks do
+# not fight: our own 'ShopDB Kiosk*.lnk', ANY .lnk that launches Edge in --kiosk
+# mode, and any .url pointing at a shopdb kiosk page. Unrelated Startup items are
+# left alone.
+Get-ChildItem -LiteralPath $startup -Filter '*.lnk' -ErrorAction SilentlyContinue | ForEach-Object {{
+    $drop = $false
+    if ($_.Name -like 'ShopDB Kiosk*') {{ $drop = $true }}
+    else {{
+        try {{
+            $existing = $shell.CreateShortcut($_.FullName)
+            if ($existing.TargetPath -match 'msedge\\.exe$' -and $existing.Arguments -match '--kiosk') {{ $drop = $true }}
+        }} catch {{}}
+    }}
+    if ($drop) {{ Remove-Item -LiteralPath $_.FullName -Force -ErrorAction SilentlyContinue }}
+}}
+Get-ChildItem -LiteralPath $startup -Filter '*.url' -ErrorAction SilentlyContinue | ForEach-Object {{
+    try {{
+        $body = Get-Content -LiteralPath $_.FullName -Raw -ErrorAction Stop
+        if ($body -match '/shopdb/(tv|shopfloor|parts-kiosk)' -or $body -match 'shopfloor-dashboard') {{
+            Remove-Item -LiteralPath $_.FullName -Force -ErrorAction SilentlyContinue
+        }}
+    }} catch {{}}
+}}
 
 $edgeArgs = "--kiosk `"$kioskUrl`" --edge-kiosk-type=fullscreen --no-first-run --no-default-browser-check"
 $lnkPath = Join-Path $startup 'ShopDB Kiosk.lnk'
-$shell = New-Object -ComObject WScript.Shell
 $lnk = $shell.CreateShortcut($lnkPath)
 $lnk.TargetPath = $edge
 $lnk.Arguments = $edgeArgs