put the shell configuration in one place, after everything it configures

The Shell section moves to 26, after Neovim, the runtimes and the agent CLIs.
Everything that writes to .zshrc now happens there and only there: the starship
init, the PATH for the agent CLIs (moved out of that section), the aliases, and
the editor.

That ordering is what the editor choice needs — it offers whichever of nvim, vim
and nano are actually present, so it has to run after Neovim is installed rather
than naming an editor that is not there. Which was the original's mistake in the
other direction: it set core.editor to nvim four sections before installing it.

The default editor is the setting git's core.editor was deliberately left out in
favour of. EDITOR, VISUAL and SUDO_EDITOR go in the account's shell, and the
Debian `editor` alternative is set too — an account's shell config cannot reach
root or sudoedit, and those are exactly the cases where the wrong editor is most
annoying.

Recorded a limitation of append_once while cleaning up after it: renaming a
marker orphans the block that used the old name, and changing a block's content
does nothing because the marker is still found. Both need the old block removed
by hand. This run left exactly that — a `local-bin` block superseded by
`agent-clis` — in the dev box's .zshrc, now removed.

UFW is deliberately still unported and will be last, for the reason the original
gave: it is the one step that can cut the connection the run is happening over.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/files.sh

@@ -103,6 +103,12 @@ install_config() {
 #   EOF
 #
 # Returns 0 if it wrote, 1 if the block was already there.
+#
+# One limitation, and it bites the author rather than the user: RENAMING a marker
+# orphans the block that used the old name. append_once only recognises the name
+# it is given, so the previous block stays in the file doing whatever it did.
+# Changing a block's CONTENT has the same shape — the marker is found, so the new
+# content is never written. Both need the old block removed by hand.
 append_once() {
   local file="$1" name="$2"
   local begin="# >>> machine-setup: ${name} >>>"