Add a signed Npcap frame-forwarding lab helper

[btsouth]

Add a bounded Npcap 1.89 forwarding helper for disposable wired Windows labs, on top of #229. Verify manually installed signed files and exact adapter/QEMU identities. Preserve guest MACs and deliver host traffic with receive injection and completed checksums. The helper changes no network configuration.

Validation:

• 37 packet and argument checks pass in native PowerShell 5.1 and devbox PowerShell Core.
• Windows VM DHCP, DNS, direct host/peer TCP, raw Ethernet, broadcast/multicast, IPv6 ping and private services pass. Guest MAC and DHCP hardware address are preserved.
• Adapter rename and virtual Ethernet loss/recovery pass. Duplicate startup and mismatched PNP identity are rejected while existing forwarding stays usable.

Related to #166. Npcap is a manual external dependency and is not bundled. This is a lab helper. Launcher integration, host segmentation offload, physical Ethernet and Secure Boot/HVCI acceptance remain open. NAT and forwarding remain the launcher defaults.