geenforce: display scope is self-sufficient, no common inheritance

Per decision: displays need none of the fleet-wide common scope's software, so
the gea-shopfloor-display scope carries everything it enforces and does not
inherit common. This avoids repackaging common's SMB-backed payloads for a
share-less display.

- Invert the client common-merge switch: -NoCommon (default-on) becomes
  -IncludeCommon (default OFF). A scope now enforces alone unless opted in.
  The capability stays for a future share-less non-display PC; displays omit it.
- Drop the common SMB-payload audit + inheritance sections from the display
  seed comments and docs (GE-ENFORCE-DISPLAY.md); document self-sufficiency.
- GE-ENFORCE-CLIENT.md: common-scope inheritance is now opt-in.

tests/test_plugins/test_geenforce_display_seed.py

@@ -21,7 +21,8 @@ def test_seed_creates_display_scope(db):
     scope = ManifestScope.query.filter_by(
         scopename=SCOPE_NAME, phase='runtime').first()
     assert scope is not None
-    # Not the common scope: the client merges common underneath at fetch time.
+    # A plain runtime scope, not the common scope. Displays are self-sufficient
+    # and do NOT inherit common.
     assert scope.iscommon is False
 
     # Four Registry drift-heal entries + one PS1 dispatcher, in order.