feat: improve Windows setup with scoop fallback and profile fixes

[tctibbs]

Summary

• Scoop fallback for all tools: install script now tries winget first, falls back to scoop — works on Windows LTSC/Server where winget is absent
• Rust toolchain fix: replaced standalone `rust` + winget rustup with `rustup-gnu` + `mingw`, avoiding MSVC linker conflict from scoop git's `cc.exe`
• Font install via scoop: replaced brittle manual download/copy with `scoop nerd-fonts/FiraCode-NF`
• Scoop-first for binary tools: yazi, onefetch, dust, procs, difftastic install from scoop (pre-built) instead of cargo
• Windows chezmoi fix: `.sh` scripts ignored on Windows, preventing `fork/exec` errors on `chezmoi apply`
• Secrets hook: profile sources `claude_env.ps1` if present; gitignored so machine-local env vars never hit the repo
• Profile dot-source fix: alias path uses `$MyInvocation.MyCommand.Path` instead of `$PSScriptRoot` (empty when dot-sourced)

Test plan

• Run `chezmoi init --apply tctibbs/dotfiles` on a clean Windows machine (with and without winget)
• Verify all CLI tools install correctly
• Verify FiraCode Nerd Font installs and registers
• Verify `. $PROFILE` correctly loads aliases (`cc`, `ccc`, etc.)
• Verify `claude_env.ps1` is not tracked by chezmoi

🤖 Generated with Claude Code