Modernize the Windows installer, tray and runtime control; fix lifecycle bugs.

Installer: dynamic light/dark Win11 style, new brand wizard images, auto
language, exclusive run mode (tray / Windows service) plus autostart and
auto-update on the Tasks page (pre-selected from what is installed on
upgrades, untouched by silent updates), 5 localized Start Menu entries.

Tray: theme-aware rounded menu with live status, icons and status-dot tray
icon; health polled off the UI thread; Settings submenu toggles autostart
and daily updates; browser opened de-elevated via explorer.

Fixes:
- tray Stop/Start was ignored in service mode (service_run restarted the
  children) - all start/stop now goes through runtime_ctl.ps1
- logon tray task and SYSTEM service task were killed after 72h (default
  ExecutionTimeLimit); autostart was registered for the elevating account
  and opened a browser on every logon
- uninstall left the NetXTray/NetXUpdate tasks behind
- silent auto-update killed the tray without restarting it
- repair_venv.ps1 was never staged into the release
- wildcard NETX_HOST (0.0.0.0) broke health checks
- ICO frames were PNG, which System.Drawing decodes as noise; icons now
  use the current brand mark

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/_common.ps1

@@ -282,6 +282,37 @@ function Test-NetxApiHealthy {
     }
 }
 
+function Get-NetxClientHost {
+    param([string]$BindHost = "")
+    # A wildcard bind address is not connectable on Windows; probe/open via loopback.
+    $h = "$BindHost".Trim()
+    if (-not $h -or $h -in @("0.0.0.0", "::", "[::]", "*")) { return "127.0.0.1" }
+    return $h
+}
+
+function Open-NetxUrl {
+    param([Parameter(Mandatory = $true)][string]$Url)
+    # Packaged scripts run elevated; Start-Process <url> would launch the browser
+    # elevated too. explorer.exe hands the URL to the user's non-elevated shell.
+    try {
+        Start-Process -FilePath (Join-Path $env:SystemRoot "explorer.exe") -ArgumentList "`"$Url`"" | Out-Null
+        return
+    } catch {}
+    try { Start-Process $Url | Out-Null } catch {}
+}
+
+function Get-NetxManagedRunner {
+    # "service" (WinSW) / "task" (SYSTEM startup task) own the runtime when present;
+    # killing their children directly would just make service_run.ps1 restart them.
+    $svc = Get-Service -Name "NetX" -ErrorAction SilentlyContinue
+    if ($svc -and [string]$svc.StartType -ne "Disabled") { return "service" }
+    try {
+        $t = Get-ScheduledTask -TaskName "NetXService" -TaskPath "\NetX\" -ErrorAction Stop
+        if ([string]$t.State -ne "Disabled") { return "task" }
+    } catch {}
+    return ""
+}
+
 function Wait-NetxApiHealthy {
     param(
         [string]$HostName = "127.0.0.1",