check_nt works with the real nagios-plugins client again

A small bugfix release: it restores compatibility between the legacy check_nt server (NSClientServer) and the real nagios-plugins check_nt client — broken since 0.12.2 — and pins the fix with an integration suite that drives the genuine client against NSClient++ in CI. It also reorganises the reference documentation for readability.

Highlights

• check_nt requests without a trailing newline are answered again. Buffer-cap hardening in 0.12.2 made the server wait for a newline terminator, but the real nagios-plugins check_nt sends <password>&<cmd>&<args> with no terminator — so every one of its requests has hung until the client's socket timeout (No data was received from host!) in every release since (#1421).
• The fix is pinned by a real-client integration suite. CI now compiles check_nt from the official nagios-plugins 2.5 release and drives it against the server, covering the protocol commands, password enforcement and the allow command gating (#1421).
• Securing check_nt is now documented. New guidance covers the password, allowed hosts and the allow setting that limits which commands the legacy endpoint will answer.
• Reference docs reorganised. Queries are listed first and every command carries an OS column with platform logos, so it is clear at a glance what exists on Windows vs Linux.

Detailed changes

check_nt — compatibility with the real nagios-plugins client restored

The buffer-cap hardening that shipped in 0.12.2 made the legacy check_nt server wait for a newline terminator before parsing a request. The real nagios-plugins check_nt sends its request with no terminator and waits for the reply, so every request from it has hung until the client's own socket timeout in every release since. End-of-read is once again end-of-request, while both halves of the hardening are kept: the 4 KiB request cap, and the newline path (which consumes the terminator and leaves pipelined bytes intact) for line-oriented clients.

The behaviour is now pinned at two levels: unit tests on the request parser (no-terminator format, newline path, empty chunk, oversized-line cap), and an integration suite that compiles check_nt from the official nagios-plugins 2.5 tarball in a container and runs it against nscp test — covering CLIENTVERSION, UPTIME, CPULOAD, MEMUSE, USEDDISKSPACE and PROCSTATE, wrong-password handling, and the allow command gating including its fail-closed behaviour (#1421).

Documentation

• New guidance on securing the legacy check_nt (NSClientServer) endpoint: set a password, restrict allowed hosts, and use the allow setting to limit which commands it answers.
• The reference docs put queries first and add an OS column with platform logos to every command.

Packaging

• Automatic Chocolatey publishing on release is disabled while the package onboarding with chocolatey.org is being sorted out (#1422). The workflow can still be run manually; the MSI, DEB, RPM and ZIP packages are unaffected.

Upgrade notes

• check_nt clients that never sent a trailing newline get answers again. If you scripted around the hang (client-side timeouts, retries, or switching clients), those workarounds are no longer needed. No configuration change is required; the default install is unaffected unless NSClientServer is enabled.
• Chocolatey: NSClient++ is not yet available from chocolatey.org; use the MSI from the release page for Windows installs.

Full Changelog: 0.16.2...0.16.3