fix: guard newUsers.ps1 against re-run after profile reset

src/playbook/Executables/AtlasModules/Scripts/newUsers.ps1

@@ -1,3 +1,17 @@
+# On Windows 24H2/25H2, a sleep/wake cycle can cause Windows to recreate an existing user profile
+# from the Default template. This re-triggers the RunOnce entry and runs this script a second time,
+# which forces a logoff and wipes the user's settings.
+#
+# To prevent this, we write a completion marker to HKLM after setup finishes (see bottom of script).
+# HKLM survives profile resets; HKCU lives inside the profile folder and would be wiped along with it.
+#
+# The marker key is the user's SID (Security Identifier) — a unique, permanent ID assigned to each
+# Windows account. Unlike a username, the SID never changes even if the profile is deleted and
+# recreated. Using it as the key name lets us track setup state per user on shared machines.
+$sid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+$marker = Get-ItemProperty -Path 'HKLM:\SOFTWARE\AtlasOS\UserSetup' -Name $sid -ErrorAction SilentlyContinue
+if ($marker.$sid -eq 1) { exit }
+
 $windir = [Environment]::GetFolderPath('Windows')
 & "$windir\AtlasModules\initPowerShell.ps1"
 $atlasDesktop = "$windir\AtlasDesktop"
@@ -74,6 +88,16 @@ if ([string]::IsNullOrWhiteSpace($browser)) {
 $null = New-Item -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Search' -Force -ErrorAction SilentlyContinue
 Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Search' -Name 'SearchboxTaskbarMode' -Value 1 -Type DWord -Force
 
+# Write the completion marker for this user so the guard above exits early on any future re-run.
+# -Force creates the registry key if it does not exist yet (idempotent, no pre-check needed).
+# This script runs as SYSTEM via RunOnce, so HKLM writes succeed without elevation issues.
+try {
+    $null = New-Item -Path 'HKLM:\SOFTWARE\AtlasOS\UserSetup' -Force -ErrorAction SilentlyContinue
+    Set-ItemProperty -Path 'HKLM:\SOFTWARE\AtlasOS\UserSetup' -Name $sid -Value 1 -Type DWord -Force
+} catch {
+    Write-Warning "Failed to write setup marker for SID '$sid': $($_.Exception.Message)"
+}
+
 # Leave
-Start-Sleep 5 
-logoff
+Start-Sleep 5
+logoff