Shkarko NSClient++ 0.25.0

# The agent reports configuration it ignores, and a robustness pass over scripting and concurrency

0.25.0 makes misconfiguration visible: a section or key nothing reads is now logged, shown in the web UI and reported by `nscp settings --validate`. Collector-backed checks gain a `warmup-state` option, `kill tree` finally works on Linux, and the rest of the release is the harvest of a stress harness, a concurrency audit and a full test of the Lua and Python APIs: a Lua crash under concurrent calls, socket requests stuck behind unrelated slow checks, duplicated events and client payloads, and a long list of smaller fixes.

## ✨ Highlights

- 🔍 **Configuration nothing reads is reported.** A misspelled section, a section without its leading `/`, or a key above the first section used to be ignored without a word. The agent now warns about each one at startup and on every reload, the web UI shows a *Configuration problems* banner, and `nscp settings --validate` exits with `1` when it finds any (#647, #1657).
- ⏱️ **`warmup-state` for collector-backed checks.** `check_cpu`, `check_load` and, on Linux and macOS, `check_memory`, `check_pagefile` and `check_network` can report `ok` (or any other status) instead of UNKNOWN while the collector takes its first sample, so a restart need not raise alerts. A collector that is disabled or failing now says so instead of reporting zeros (#1621).
- 🐧 **`kill tree` works on Linux.** The script runs in a session of its own and a timeout signals the whole process group, so backgrounded helpers die with it; unloading CheckExternalScripts now ends running scripts (#1629).
- 🔒 **Lua and Python scripting hardened.** A Lua check running twice at once could crash the agent; listing scripts over REST ran every check; and a test of every documented API fixed a dozen bindings that did nothing or crashed (#1642, #1636, #1632).
- 📡 **Socket servers no longer queue behind slow checks.** About one NRPE, NSCA, check_mk or NSClient request in a few hundred waited for an unrelated long-running check, which showed up as an occasional `Socket timeout` (#1642).
- 🔒 **OpenSSL 3.5.9** in the Windows builds, from the 29 September 2026 upstream security release (#1666).

## ⚠️ Upgrade notes

The full list is on the [upgrading page](https://nsclient.org/docs/setup/upgrading/), and the security fixes on the
[security notices page](https://nsclient.org/docs/security/notices/).

- **`nscp settings --validate` can now exit with `1`.** A script or pipeline that runs it fails on any unread section or key; fix the reported entries.
- **Fleet host overrides now win over bundles.** If a host override sets a key a bundle also sets, the host switches to the override's value; check your overrides if you relied on the bundle winning.
- **Aliases containing `\n` are refused.** Check the log for `Refusing alias` after upgrading; write `\\n` for a literal, and Windows paths with `/` or doubled backslashes.
- **Log-matching rules.** The *rejected connection* lines (now one line), check_nt's *No performance data* error and `check_pdh`'s `Failed to add counter` text changed; match the new prefixes.
- **LUAScript reloads re-run `on_start`**, and Lua `require()` / CheckMKClient scripts resolve from `${scripts}`; check scripts that must run once, or helpers kept under the install base with a custom `${scripts}`.
- **PythonScript** passes `python` as `plugin_alias` and `Core.simple_exec` reports failures as UNKNOWN; check scripts that test for `""`, `0` or `False`.
- **Linux `kill tree = true`** now runs the script in its own session; a script that calls `setsid()` itself gets `EPERM`.
- **Permission policy:** a reload that fails part-way now denies exec until a later reload succeeds. Nothing changes unless `[/settings/permissions] enabled = true`.

**Full Changelog**: https://github.com/mickem/nscp/compare/0.24.1...0.25.0