feat(packaging): move the CLI into nexusos_cli and make the wheel self-sufficient

The CLI shipped from `management/`, which also holds desktop-only pieces (the
Tk control panel, the XFCE panel wiring, the shell wrappers). Packaging that
directory meant the wheel either dragged in tkinter or shipped a broken import.
Split it: `nexusos_cli/` is what the wheel ships and what `nexus`/`ncp`/
`nexusos` dispatch to, `management/` keeps the desktop half.

Alongside the move:

* hatch_build.py decides the interface/web/dist include at build time. dist/
  is gitignored, so a static force-include aborts `pip install -e .` on a
  fresh clone - before the reader reaches the `npm run build` step. Editable
  installs now skip a missing dist; wheels and sdists hard-error naming the
  command to run.
* synapse/proc_util.py gives frontend_manager and ncp process inspection and
  termination without psutil, which became an optional extra when the wheel
  landed. It routes around Windows having no signals, where os.kill(pid, 15)
  is an unblockable TerminateProcess rather than a polite request.
* nexusos_cli/monitor.py adds `ncp monitor`, an ASCII dashboard with no curses
  or rich dependency so it works in Termux, plain SSH and Windows Terminal.
  Collector and renderer are separate so tests feed fixtures, no stack needed.
* tests/test_packaging_deps.py fails the gate when synapse or nexusos_cli
  import a distribution pyproject does not declare, and when an optional
  dependency is imported at module scope instead of lazily.
* bin/check.sh now builds the wheel, twine-checks it, and asserts the compiled
  UI and seed playbooks are actually inside it. A wheel that builds but ships
  no dist/ serves a blank page, which only shows up after release.

tests/test_nexus_api.py moves to tests/ with the module it covers.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

synapse/frontend_manager.py

@@ -12,13 +12,13 @@ import os
 import shutil
 import subprocess
 import urllib.request
-from pathlib import Path
 
 try:
     import psutil
 except ImportError:  # optional in the portable/Termux core install
     psutil = None
 
+from . import proc_util
 from .nexus_config import FRONTEND_SOURCE_DIR, RUNTIME_DIR
 
 FRONTEND_DIR = FRONTEND_SOURCE_DIR
@@ -47,11 +47,8 @@ def _is_ours(pid: int) -> bool:
     try:
         if psutil is not None:
             cmd = " ".join(psutil.Process(pid).cmdline())
-        elif os.name != "nt":
-            cmd = (Path(f"/proc/{pid}/cmdline").read_bytes()
-                   .replace(b"\0", b" ").decode(errors="replace"))
         else:
-            return False
+            cmd = proc_util.pid_cmdline(pid)
     except Exception:
         return False
     return "vite" in cmd or ("npm" in cmd and "dev" in cmd)
@@ -62,11 +59,9 @@ def _alive(pid: int | None) -> bool:
         return False
     if psutil is not None:
         return psutil.pid_exists(pid)
-    try:
-        os.kill(pid, 0)
-        return True
-    except (OSError, ValueError):
-        return False
+    # proc_util rather than os.kill(pid, 0): same probe, but it also works
+    # when the PID belongs to another user.
+    return proc_util.pid_alive(pid)
 
 
 def _http_up() -> bool:
@@ -128,8 +123,8 @@ def stop() -> dict:
                     except Exception:
                         pass
                 proc.terminate()
-            elif os.name != "nt":
-                os.kill(pid, 15)
+            else:
+                proc_util.terminate_pid(pid)
         except Exception:
             pass
     PID_FILE.unlink(missing_ok=True)