geenforce: display scope is self-sufficient, no common inheritance

Per decision: displays need none of the fleet-wide common scope's software, so
the gea-shopfloor-display scope carries everything it enforces and does not
inherit common. This avoids repackaging common's SMB-backed payloads for a
share-less display.

- Invert the client common-merge switch: -NoCommon (default-on) becomes
  -IncludeCommon (default OFF). A scope now enforces alone unless opted in.
  The capability stays for a future share-less non-display PC; displays omit it.
- Drop the common SMB-payload audit + inheritance sections from the display
  seed comments and docs (GE-ENFORCE-DISPLAY.md); document self-sufficiency.
- GE-ENFORCE-CLIENT.md: common-scope inheritance is now opt-in.

plugins/geenforce/seed_display_scope.py

@@ -15,12 +15,11 @@ What this scope contains:
   launches the kiosk target for the subtype. The display-type -> target map is
   a data-driven table (DISPLAY_TYPE_TARGETS) so the targets are easy to edit.
 
-Inheritance: the manifest model has no inheritance column. The display scope is
-a plain (non-common) runtime scope; the CLIENT merges the fleet-wide 'common'
-scope with the display scope at fetch time. So this scope carries display-only
-entries and relies on the client to layer 'common' underneath. See the common
-SMB-payload audit in docs/GE-ENFORCE-DISPLAY.md before letting a share-less
-display inherit common.
+Self-sufficient: the display scope carries EVERYTHING a display enforces and
+does NOT inherit the fleet-wide 'common' scope. Displays run the enforcer with
+common-merge off (the client default), so common's SMB-backed fleet entries
+never reach a share-less display. This keeps the display path simple and needs
+no common-payload repackaging.
 
 Authoring path mirrors how every other scope is created: build a manifest dict
 and hand it to service.replace_scope_draft (the same call the import-share CLI
@@ -35,8 +34,6 @@ from . import service
 
 SCOPE_NAME = 'gea-shopfloor-display'
 SCOPE_PHASE = 'runtime'
-# Match the fleet-wide 'common' manifest version so a merged display + common
-# document stays internally consistent.
 SCOPE_VERSION = '2.0'
 
 # Edge kiosk relaunch policy key. Values below mirror 09-Setup-Display.ps1
@@ -222,8 +219,8 @@ def build_display_manifest():
             'gea-shopfloor-display runtime scope. Heals Edge kiosk relaunch '
             'policy drift and dispatches the kiosk to the subtype target. No '
             'EXE payloads: kiosk engine and browser are baked into the display '
-            'image. The client merges the fleet-wide common scope underneath '
-            'this one at fetch time.'),
+            'image. Self-sufficient: displays do NOT inherit the common '
+            'scope.'),
         'Applications': applications,
     }