add post_commands: runs after packages + file_associations

[tommyjcarpenter]

Summary

• New top-level config section `post_commands` (same shape as `commands`) that runs at the end of the bootstrap flow instead of the start
• Schema: factor the per-OS commands shape into a reusable `commands_section` definition; `commands` and `post_commands` both reference it
• `utils.cmds` takes a new `section_key` arg (defaults to `"commands"`) so the same plumbing handles both phases

Why

The motivating case is a step that depends on a package already being installed — e.g. registering a font file that scoop dropped on disk but didn't put in the user font registry. Without `post_commands` you'd have to either bundle install + post-install into one giant cmd (multi-line PowerShell quoted into JSON, pretty miserable to maintain) or split the work across two bootstrap runs.

Order is now:
```
mkdirs → links → commands → prereq_packages → packages →
file_associations → post_commands
```

Test plan

• `ruff check` + `ruff format --check` clean
• `sample_config.json` validates against the new schema
• Manual: dotfiles consumes `post_commands` for the VictorMono NFM font registration (separate dotfiles change, not in this PR)