Sync from upstream: ncp is Python now, runs on Windows too

management/ncp.py replaces the bash CLI's logic; nexus-cli.sh and the new
ncp.ps1 are thin wrappers, so Linux keeps its entry point and Windows gains one.
psutil handles process and port work on both platforms.

install-windows.ps1 registers ncp in the PowerShell profile. The panel VPN
switch now resolves its WireGuard connection through NetworkManager instead of
a hardcoded name, and the .ps1 ASCII guard globs rather than naming files.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_smoke.py

@@ -54,13 +54,17 @@ def test_default_models_have_one_source_of_truth():
         assert hardcoded not in ps1, f"install-windows.ps1 hardcodes {hardcoded!r}"
 
 
-def test_install_windows_stays_ascii():
+def test_powershell_files_stay_ascii():
     # PowerShell 5.1 decodes BOM-less files as ANSI: one stray Unicode dash
-    # eats a quote and the whole script dies at parse time.
-    for name in ("install-windows.ps1", "launch_nexus.ps1"):
-        raw = (REPO_ROOT / name).read_bytes()
+    # eats a quote and the whole script dies at parse time. Globbed rather than
+    # listed by name so a newly added .ps1 is covered without editing this test.
+    skip = {"Promethean", "node_modules", ".git", "dist"}
+    ps1s = [p for p in REPO_ROOT.rglob("*.ps1") if not skip & set(p.parts)]
+    assert ps1s, "no .ps1 files found - did the Windows path move?"
+    for path in ps1s:
+        raw = path.read_bytes()
         bad = [(i, b) for i, b in enumerate(raw) if b > 0x7F]
-        assert not bad, f"{name} has non-ASCII bytes at {bad[:3]}"
+        assert not bad, f"{path.relative_to(REPO_ROOT)} has non-ASCII bytes at {bad[:3]}"
 
 
 def test_first_playbook_is_the_system_prompt(tmp_path, monkeypatch):