nebula's built-in Go service manager (-service install) is unreliable
on Windows — it reports "service already exists" when the SCM, registry,
and Get-Service all confirm no service is present. Use PowerShell's
New-Service cmdlet instead, which talks directly to the Windows SCM.
Nebula recreates the nebula1 TUN adapter on every start, wiping DNS settings. This caused domain authentication to fail at the Windows login screen because Netlogon could not reach the DC.
Changes:
- install-nebula.ps1 now takes -DnsServer and -Domain parameters
- Changed service start type from delayed-auto to auto
- Creates set-dns-on-start.ps1 startup script and NebulaDNS scheduled task
- Sets ExpectedDialupDelay=60 in Netlogon registry
- Idempotency check verifies scheduled task and startup script exist
