feat: add Windows NRPT and WFP DNS interception

Implement DNS interception on Windows with dual-mode support:
- NRPT for --intercept-mode=dns: catch-all rule redirecting all DNS
  to ctrld's listener, with GP vs local path detection
- WFP for --intercept-mode=hard: sublayer with callout filters
  intercepting port 53 traffic
- NRPT probe-and-heal for async Group Policy refresh race
- Service registry verification for intercept mode persistence
- NRPT diagnostics script for troubleshooting

Includes WFP technical reference docs and Windows test scripts.

Squashed from intercept mode development on v1.0 branch (#497).

cmd/cli/os_windows.go

@@ -55,7 +55,7 @@ func setDNS(iface *net.Interface, nameservers []string) error {
 				mainLog.Load().Debug().Msgf("Existing forwarders content: %s", string(oldForwardersContent))
 			}
 
-			hasLocalIPv6Listener := needLocalIPv6Listener()
+			hasLocalIPv6Listener := needLocalIPv6Listener(interceptMode)
 			mainLog.Load().Debug().Bool("has_ipv6_listener", hasLocalIPv6Listener).Msg("IPv6 listener status")
 
 			forwarders := slices.DeleteFunc(slices.Clone(nameservers), func(s string) bool {