Modernize the Windows installer, tray and runtime control; fix lifecycle bugs.

Installer: dynamic light/dark Win11 style, new brand wizard images, auto
language, exclusive run mode (tray / Windows service) plus autostart and
auto-update on the Tasks page (pre-selected from what is installed on
upgrades, untouched by silent updates), 5 localized Start Menu entries.

Tray: theme-aware rounded menu with live status, icons and status-dot tray
icon; health polled off the UI thread; Settings submenu toggles autostart
and daily updates; browser opened de-elevated via explorer.

Fixes:
- tray Stop/Start was ignored in service mode (service_run restarted the
  children) - all start/stop now goes through runtime_ctl.ps1
- logon tray task and SYSTEM service task were killed after 72h (default
  ExecutionTimeLimit); autostart was registered for the elevating account
  and opened a browser on every logon
- uninstall left the NetXTray/NetXUpdate tasks behind
- silent auto-update killed the tray without restarting it
- repair_venv.ps1 was never staged into the release
- wildcard NETX_HOST (0.0.0.0) broke health checks
- ICO frames were PNG, which System.Drawing decodes as noise; icons now
  use the current brand mark

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packaging/runtime_ctl.ps1

@@ -0,0 +1,52 @@
+param(
+    [ValidateSet("start", "stop", "restart")]
+    [string]$Action = "start",
+    [string]$ProgramRoot = "",
+    [string]$DataRoot = ""
+)
+
+# Single start/stop/restart entry for tray + shortcuts. Routes through the
+# Windows service / SYSTEM task when one is installed, else the plain scripts.
+
+$ErrorActionPreference = "Stop"
+. "$PSScriptRoot\_common.ps1"
+Assert-NetxAdminOrRelaunch -ScriptPath $PSCommandPath -BoundParameters $PSBoundParameters -WindowStyle Hidden
+
+$prog = Get-NetxProgramRoot -Override $ProgramRoot
+$data = Get-NetxDataRoot -ProgramRoot $prog -Override $DataRoot
+
+function Invoke-NetxChildScript([string]$Name, [string[]]$Extra = @()) {
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot $Name) `
+        -ProgramRoot $prog -DataRoot $data @Extra
+    return $LASTEXITCODE
+}
+
+$runner = Get-NetxManagedRunner
+switch ($runner) {
+    "service" {
+        switch ($Action) {
+            "start" { Start-Service -Name "NetX" }
+            "stop" { Stop-Service -Name "NetX" -Force }
+            "restart" { Restart-Service -Name "NetX" -Force }
+        }
+    }
+    "task" {
+        if ($Action -ne "start") {
+            Stop-ScheduledTask -TaskName "NetXService" -TaskPath "\NetX\"
+            $null = Invoke-NetxChildScript "stop_netx_app.ps1"
+        }
+        if ($Action -ne "stop") {
+            Start-ScheduledTask -TaskName "NetXService" -TaskPath "\NetX\"
+        }
+    }
+    default {
+        if ($Action -ne "start") {
+            $null = Invoke-NetxChildScript "stop_netx_app.ps1"
+        }
+        if ($Action -ne "stop") {
+            $code = Invoke-NetxChildScript "start_netx_app.ps1" @("-SkipBrowser")
+            if ($code) { exit $code }
+        }
+    }
+}
+exit 0