geenforce: display scope is self-sufficient, no common inheritance

Per decision: displays need none of the fleet-wide common scope's software, so
the gea-shopfloor-display scope carries everything it enforces and does not
inherit common. This avoids repackaging common's SMB-backed payloads for a
share-less display.

- Invert the client common-merge switch: -NoCommon (default-on) becomes
  -IncludeCommon (default OFF). A scope now enforces alone unless opted in.
  The capability stays for a future share-less non-display PC; displays omit it.
- Drop the common SMB-payload audit + inheritance sections from the display
  seed comments and docs (GE-ENFORCE-DISPLAY.md); document self-sufficiency.
- GE-ENFORCE-CLIENT.md: common-scope inheritance is now opt-in.

plugins/geenforce/client/Invoke-ShopdbEnforce.ps1

@@ -24,15 +24,16 @@
 .PARAMETER ShadowMode
   Fetch + compare + report, but install from the share (no behavior change).
 
-.PARAMETER CommonScope
-  The fleet-wide scope every PC inherits (default 'common'). Its manifest is
-  fetched in addition to -Scope and merged in, so a display enforces its own
-  scope entries PLUS common's. On a Name conflict the -Scope (pctype) entry
-  wins. Set -NoCommon to disable, or point at a different common scope name.
+.PARAMETER IncludeCommon
+  Also fetch the fleet-wide CommonScope and merge it into -Scope, so the PC
+  enforces its own scope entries PLUS common's (on a Name conflict the -Scope
+  entry wins). OFF by default: a scope is enforced ALONE (self-sufficient).
+  Displays are self-sufficient and do NOT set this. Only a share-less non-display
+  PC that genuinely needs the fleet-wide common entries over HTTPS turns it on.
 
-.PARAMETER NoCommon
-  Do not fetch or merge the common scope; enforce -Scope alone (the original
-  single-scope behavior).
+.PARAMETER CommonScope
+  Name of the fleet-wide scope merged when -IncludeCommon is set (default
+  'common'). Ignored without -IncludeCommon.
 
 .NOTES
   Fail-safe: any error exits 0 so a bad web app never blocks or breaks a PC.
@@ -44,8 +45,8 @@ param(
     [Parameter(Mandatory)] [string]$EnginePath,
     [string]$ShareManifestPath,
     [switch]$ShadowMode,
+    [switch]$IncludeCommon,
     [string]$CommonScope = 'common',
-    [switch]$NoCommon,
     [string]$BaseUrl,
     [string]$ApiToken,
     [string]$LogFile = "C:\Logs\Shopfloor\shopdb-enforce-$(Get-Date -Format yyyyMMdd).log"
@@ -126,12 +127,13 @@ try {
         # no common merge - the share already carries its own common scope).
         $manifestToRun = $ShareManifestPath
     } else {
-        # Common-scope inheritance: a display enforces its own scope PLUS the
-        # fleet-wide common scope. Fetch common too (best-effort, same fail-safe
-        # cache) and merge it in with the pctype winning on conflict. Skipped
-        # when -NoCommon, or when this run IS the common scope.
+        # Optional common-scope inheritance (OFF by default; displays are
+        # self-sufficient). Only when -IncludeCommon is set do we fetch the
+        # fleet-wide common scope (best-effort, same fail-safe cache) and merge
+        # it in with the pctype winning on conflict. Skipped when this run IS
+        # the common scope.
         $manifestToMerge = $sync.Path
-        if (-not $NoCommon -and $CommonScope -and ($CommonScope -ine $Scope)) {
+        if ($IncludeCommon -and $CommonScope -and ($CommonScope -ine $Scope)) {
             $commonSync = Sync-ShopdbManifest -Scope $CommonScope -Config $config
             if ($commonSync.Path) {
                 $manifestToMerge = Merge-ShopdbManifests -PrimaryManifestPath $sync.Path -CommonManifestPath $commonSync.Path

plugins/geenforce/seed_display_scope.py

@@ -15,12 +15,11 @@ What this scope contains:
   launches the kiosk target for the subtype. The display-type -> target map is
   a data-driven table (DISPLAY_TYPE_TARGETS) so the targets are easy to edit.
 
-Inheritance: the manifest model has no inheritance column. The display scope is
-a plain (non-common) runtime scope; the CLIENT merges the fleet-wide 'common'
-scope with the display scope at fetch time. So this scope carries display-only
-entries and relies on the client to layer 'common' underneath. See the common
-SMB-payload audit in docs/GE-ENFORCE-DISPLAY.md before letting a share-less
-display inherit common.
+Self-sufficient: the display scope carries EVERYTHING a display enforces and
+does NOT inherit the fleet-wide 'common' scope. Displays run the enforcer with
+common-merge off (the client default), so common's SMB-backed fleet entries
+never reach a share-less display. This keeps the display path simple and needs
+no common-payload repackaging.
 
 Authoring path mirrors how every other scope is created: build a manifest dict
 and hand it to service.replace_scope_draft (the same call the import-share CLI
@@ -35,8 +34,6 @@ from . import service
 
 SCOPE_NAME = 'gea-shopfloor-display'
 SCOPE_PHASE = 'runtime'
-# Match the fleet-wide 'common' manifest version so a merged display + common
-# document stays internally consistent.
 SCOPE_VERSION = '2.0'
 
 # Edge kiosk relaunch policy key. Values below mirror 09-Setup-Display.ps1
@@ -222,8 +219,8 @@ def build_display_manifest():
             'gea-shopfloor-display runtime scope. Heals Edge kiosk relaunch '
             'policy drift and dispatches the kiosk to the subtype target. No '
             'EXE payloads: kiosk engine and browser are baked into the display '
-            'image. The client merges the fleet-wide common scope underneath '
-            'this one at fetch time.'),
+            'image. Self-sufficient: displays do NOT inherit the common '
+            'scope.'),
         'Applications': applications,
     }