geenforce: display scope is self-sufficient, no common inheritance

Per decision: displays need none of the fleet-wide common scope's software, so
the gea-shopfloor-display scope carries everything it enforces and does not
inherit common. This avoids repackaging common's SMB-backed payloads for a
share-less display.

- Invert the client common-merge switch: -NoCommon (default-on) becomes
  -IncludeCommon (default OFF). A scope now enforces alone unless opted in.
  The capability stays for a future share-less non-display PC; displays omit it.
- Drop the common SMB-payload audit + inheritance sections from the display
  seed comments and docs (GE-ENFORCE-DISPLAY.md); document self-sufficiency.
- GE-ENFORCE-CLIENT.md: common-scope inheritance is now opt-in.

plugins/geenforce/client/Invoke-ShopdbEnforce.ps1

@@ -24,15 +24,16 @@
 .PARAMETER ShadowMode
   Fetch + compare + report, but install from the share (no behavior change).
 
-.PARAMETER CommonScope
-  The fleet-wide scope every PC inherits (default 'common'). Its manifest is
-  fetched in addition to -Scope and merged in, so a display enforces its own
-  scope entries PLUS common's. On a Name conflict the -Scope (pctype) entry
-  wins. Set -NoCommon to disable, or point at a different common scope name.
+.PARAMETER IncludeCommon
+  Also fetch the fleet-wide CommonScope and merge it into -Scope, so the PC
+  enforces its own scope entries PLUS common's (on a Name conflict the -Scope
+  entry wins). OFF by default: a scope is enforced ALONE (self-sufficient).
+  Displays are self-sufficient and do NOT set this. Only a share-less non-display
+  PC that genuinely needs the fleet-wide common entries over HTTPS turns it on.
 
-.PARAMETER NoCommon
-  Do not fetch or merge the common scope; enforce -Scope alone (the original
-  single-scope behavior).
+.PARAMETER CommonScope
+  Name of the fleet-wide scope merged when -IncludeCommon is set (default
+  'common'). Ignored without -IncludeCommon.
 
 .NOTES
   Fail-safe: any error exits 0 so a bad web app never blocks or breaks a PC.
@@ -44,8 +45,8 @@ param(
     [Parameter(Mandatory)] [string]$EnginePath,
     [string]$ShareManifestPath,
     [switch]$ShadowMode,
+    [switch]$IncludeCommon,
     [string]$CommonScope = 'common',
-    [switch]$NoCommon,
     [string]$BaseUrl,
     [string]$ApiToken,
     [string]$LogFile = "C:\Logs\Shopfloor\shopdb-enforce-$(Get-Date -Format yyyyMMdd).log"
@@ -126,12 +127,13 @@ try {
         # no common merge - the share already carries its own common scope).
         $manifestToRun = $ShareManifestPath
     } else {
-        # Common-scope inheritance: a display enforces its own scope PLUS the
-        # fleet-wide common scope. Fetch common too (best-effort, same fail-safe
-        # cache) and merge it in with the pctype winning on conflict. Skipped
-        # when -NoCommon, or when this run IS the common scope.
+        # Optional common-scope inheritance (OFF by default; displays are
+        # self-sufficient). Only when -IncludeCommon is set do we fetch the
+        # fleet-wide common scope (best-effort, same fail-safe cache) and merge
+        # it in with the pctype winning on conflict. Skipped when this run IS
+        # the common scope.
         $manifestToMerge = $sync.Path
-        if (-not $NoCommon -and $CommonScope -and ($CommonScope -ine $Scope)) {
+        if ($IncludeCommon -and $CommonScope -and ($CommonScope -ine $Scope)) {
             $commonSync = Sync-ShopdbManifest -Scope $CommonScope -Config $config
             if ($commonSync.Path) {
                 $manifestToMerge = Merge-ShopdbManifests -PrimaryManifestPath $sync.Path -CommonManifestPath $commonSync.Path