Modernize the Windows installer, tray and runtime control; fix lifecycle bugs.

Installer: dynamic light/dark Win11 style, new brand wizard images, auto
language, exclusive run mode (tray / Windows service) plus autostart and
auto-update on the Tasks page (pre-selected from what is installed on
upgrades, untouched by silent updates), 5 localized Start Menu entries.

Tray: theme-aware rounded menu with live status, icons and status-dot tray
icon; health polled off the UI thread; Settings submenu toggles autostart
and daily updates; browser opened de-elevated via explorer.

Fixes:
- tray Stop/Start was ignored in service mode (service_run restarted the
  children) - all start/stop now goes through runtime_ctl.ps1
- logon tray task and SYSTEM service task were killed after 72h (default
  ExecutionTimeLimit); autostart was registered for the elevating account
  and opened a browser on every logon
- uninstall left the NetXTray/NetXUpdate tasks behind
- silent auto-update killed the tray without restarting it
- repair_venv.ps1 was never staged into the release
- wildcard NETX_HOST (0.0.0.0) broke health checks
- ICO frames were PNG, which System.Drawing decodes as noise; icons now
  use the current brand mark

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/launch_shortcut.ps1

@@ -79,7 +79,7 @@ try {
             }
         }
         "stop" {
-            $p = Invoke-NetxHiddenPs1 -File (Join-Path $PSScriptRoot "stop_netx_app.ps1")
+            $p = Invoke-NetxHiddenPs1 -File (Join-Path $PSScriptRoot "runtime_ctl.ps1") -ExtraArgs @("-Action", "stop")
             if ($null -ne $p.ExitCode -and $p.ExitCode -ne 0) { throw "stop_exit_$($p.ExitCode)" }
         }
         "update" {
@@ -102,10 +102,11 @@ try {
                 if ($map["NETX_HOST"]) { $hostBind = $map["NETX_HOST"] }
                 if ($map["NETX_PORT"]) { try { $port = [int]$map["NETX_PORT"] } catch {} }
             }
-            $p = Invoke-NetxHiddenPs1 -File (Join-Path $PSScriptRoot "start_netx_app.ps1") -ExtraArgs @("-SkipBrowser")
+            $hostBind = Get-NetxClientHost -BindHost $hostBind
+            $p = Invoke-NetxHiddenPs1 -File (Join-Path $PSScriptRoot "runtime_ctl.ps1") -ExtraArgs @("-Action", "start")
             if ($p.ExitCode -ne 0) { throw "start_exit_$($p.ExitCode)" }
             if (Wait-NetxApiHealthy -HostName $hostBind -Port $port -TimeoutSec 180) {
-                try { Start-Process "http://${hostBind}:${port}/" } catch {}
+                Open-NetxUrl -Url "http://${hostBind}:${port}/"
             } else {
                 throw (T `
                     "NetX started but /health not ready within 180s.`nSee: $logDir\netx.err.log" `