feat: allow postInstall to be a function of { system, pkgs }

[xAlisher]

Problem

postInstall is a single string, baked once (outside the per-system loop). When a module's postInstall
needs to inject a per-system artifact into $out — e.g. a helper binary/bundle built for the current
system — the only way to select the right per-system derivation from that one string is
builtins.currentSystem, which throws in pure eval (attribute 'currentSystem' missing) and breaks
nix build in CI (the multi-variant release runners build each variant purely on its native runner).

Fix

Let postInstall be either a string or a function { system, pkgs }: string, evaluated per-system in
buildCppPlugin (where system + pkgs are already in scope). This mirrors the existing preConfigure
function-or-string handling right above it. Plain-string postInstall is unchanged — fully backward compatible.

# a module can now do, purely:
postInstall = { system, pkgs }: ''
  mkdir -p $out/lib/bin
  cp -a ${helperBundleFor system}/. $out/lib/bin/
'';

Verified

Built a real consumer (receiver-basecamp, which ships a per-system ffplay/tor/privoxy bundle) against this
branch with a function postInstall and nix build .#lgx-portable — no --impure — succeeds and
produces the correctly-bundled .lgx per variant. Without this change the same flake needs --impure
(currentSystem) and fails the pure CI build.

Context: xAlisher/receiver-basecamp#80.