Modernize the Windows installer, tray and runtime control; fix lifecycle bugs.

Installer: dynamic light/dark Win11 style, new brand wizard images, auto
language, exclusive run mode (tray / Windows service) plus autostart and
auto-update on the Tasks page (pre-selected from what is installed on
upgrades, untouched by silent updates), 5 localized Start Menu entries.

Tray: theme-aware rounded menu with live status, icons and status-dot tray
icon; health polled off the UI thread; Settings submenu toggles autostart
and daily updates; browser opened de-elevated via explorer.

Fixes:
- tray Stop/Start was ignored in service mode (service_run restarted the
  children) - all start/stop now goes through runtime_ctl.ps1
- logon tray task and SYSTEM service task were killed after 72h (default
  ExecutionTimeLimit); autostart was registered for the elevating account
  and opened a browser on every logon
- uninstall left the NetXTray/NetXUpdate tasks behind
- silent auto-update killed the tray without restarting it
- repair_venv.ps1 was never staged into the release
- wildcard NETX_HOST (0.0.0.0) broke health checks
- ICO frames were PNG, which System.Drawing decodes as noise; icons now
  use the current brand mark

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/check_update.ps1

@@ -440,6 +440,10 @@ try {
         # (see installer/netx.iss /InstallMode=update).
         Write-Host "==> Applying update via silent Setup.exe"
         $setupArgs = "/VERYSILENT /NORESTART /SUPPRESSMSGBOXES /DIR=`"$prog`" /InstallMode=update"
+        # Setup stops the tray (StopForUpdate -KillTray); remember to bring it back.
+        $trayWasRunning = @(Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
+                $_.CommandLine -and $_.CommandLine -match 'netx_tray\.ps1'
+            }).Count -gt 0
         $sp = Start-Process -FilePath $pkgPath -ArgumentList $setupArgs -Wait -PassThru
         if ($null -eq $sp.ExitCode -or $sp.ExitCode -ne 0) {
             $code = if ($null -eq $sp.ExitCode) { "null" } else { $sp.ExitCode }
@@ -475,6 +479,14 @@ try {
                 -ProgramRoot $prog -DataRoot $data -SkipBrowser
             if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
         }
+        if ($trayWasRunning) {
+            $trayPs1 = Join-Path $prog "packaging\netx_tray.ps1"
+            if (Test-Path -LiteralPath $trayPs1) {
+                Write-Host "==> Restarting NetX tray"
+                Start-NetxPowerShell -File $trayPs1 -Arguments @("-ProgramRoot", $prog, "-DataRoot", $data, "-QuietStart") `
+                    -WorkingDirectory $prog -WindowStyle Hidden | Out-Null
+            }
+        }
     } else {
         Write-Host "==> Applying legacy zip update via update_netx.ps1"
         & powershell -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot "update_netx.ps1") `