put the shell configuration in one place, after everything it configures

The Shell section moves to 26, after Neovim, the runtimes and the agent CLIs.
Everything that writes to .zshrc now happens there and only there: the starship
init, the PATH for the agent CLIs (moved out of that section), the aliases, and
the editor.

That ordering is what the editor choice needs — it offers whichever of nvim, vim
and nano are actually present, so it has to run after Neovim is installed rather
than naming an editor that is not there. Which was the original's mistake in the
other direction: it set core.editor to nvim four sections before installing it.

The default editor is the setting git's core.editor was deliberately left out in
favour of. EDITOR, VISUAL and SUDO_EDITOR go in the account's shell, and the
Debian `editor` alternative is set too — an account's shell config cannot reach
root or sudoedit, and those are exactly the cases where the wrong editor is most
annoying.

Recorded a limitation of append_once while cleaning up after it: renaming a
marker orphans the block that used the old name, and changing a block's content
does nothing because the marker is still found. Both need the old block removed
by hand. This run left exactly that — a `local-bin` block superseded by
`agent-clis` — in the dev box's .zshrc, now removed.

UFW is deliberately still unported and will be last, for the reason the original
gave: it is the one step that can cut the connection the run is happening over.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/dev.sh

@@ -347,3 +347,35 @@ install_opencode() {
 }
 
 install_pi() { npm install -g @mariozechner/pi-coding-agent >/dev/null 2>&1; }
+
+# -----------------------------------------------------------------------------
+# Default editor
+# -----------------------------------------------------------------------------
+#
+# One preference, two mechanisms, and both are needed:
+#
+#   EDITOR / VISUAL      what the account's own shell hands to git, crontab -e,
+#                        systemctl edit and anything else that opens an editor
+#   update-alternatives  the system-wide `editor` command, which is what root and
+#                        `sudoedit` use — an account's shell config cannot reach
+#                        those
+#
+# This is the setting core.editor was deliberately left out in favour of: set it
+# here and git follows, along with everything else.
+
+editor_candidates() {
+  local e
+  for e in nvim vim nano; do command -v "$e" &>/dev/null && echo "$e"; done
+}
+
+current_editor() { (cd / && sudo -H -u "$USERNAME" bash -lc 'echo "${EDITOR:-}"' 2>/dev/null); }
+
+set_system_editor() {
+  local editor="$1" path
+  path="$(command -v "$editor")" || return 1
+  # Only where the alternatives system is in use. Absent on non-Debian systems,
+  # where there is nothing to set.
+  command -v update-alternatives &>/dev/null || return 0
+  update-alternatives --install /usr/bin/editor editor "$path" 100 >/dev/null 2>&1
+  update-alternatives --set editor "$path" >/dev/null 2>&1
+}