feat(macos): foundation of the macOS app ported from Swift to Rust

Phase 9, MA1: crates/ghostty-macos (AppKit via objc2; empty stub on
non-Apple targets) ports the foundation of Ghostty 1.3.1's Swift macOS
app (ghostty/macos): main, AppDelegate (+Ghostty) with lifecycle, dock
menu, open-file, notifications, shortcut sync and quit/reopen paths;
MainMenu.xib as generated menu tables built into NSMenus; the
Ghostty.App/Config/Surface wrappers driving libghostty in-process via
ghostty-lib; the generic helpers; scripts/macos-bundle.sh to assemble
Ghostty.app (dry-run on Linux). Feature areas are stubbed for MA2-MA5.
Design and type mapping: docs/rewrite/notes/macos-app-design.md
(App Intents is a Swift-only framework and cannot be ported).

Compile-checked only (no macOS here): just check-macos passes for
aarch64/x86_64-apple-darwin with -D warnings; 125 platform-independent
tests run on Linux.

Test Plan:
- just check-macos
- cargo test -p ghostty-macos

crates/ghostty-macos/Cargo.toml

@@ -0,0 +1,84 @@
+[package]
+name = "ghostty-macos"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Ghostty's macOS app (Sources/ of the Swift app) ported to Rust/AppKit; drives libghostty (ghostty-lib) in-process"
+
+# On non-Apple targets both the library and the binary compile to empty stubs so
+# the workspace stays green; the real code is `cfg(target_vendor = "apple")`.
+[lib]
+name = "ghostty_macos"
+
+[[bin]]
+name = "ghostty-macos-app"
+path = "src/main.rs"
+
+[dependencies]
+bitflags = "2"
+libghostty = { package = "ghostty-lib", path = "../ghostty-lib" }
+log = "0.4.34"
+
+[target.'cfg(target_vendor = "apple")'.dependencies]
+# The embedded C API, called in-process exactly like the Swift app calls
+# `ghostty.h` (renamed so it does not clash with the `ghostty` module tree).
+block2 = "0.6.2"
+dispatch2 = "0.3.1"
+libc = "0.2.190"
+objc2 = { version = "0.6.5", features = ["exception"] }
+objc2-app-kit = "0.3.2"
+objc2-core-foundation = "0.3.2"
+objc2-core-graphics = "0.3.2"
+objc2-foundation = "0.3.2"
+objc2-metal = "0.3.2"
+objc2-quartz-core = "0.3.2"
+objc2-user-notifications = "0.3.2"
+
+# The workspace forbids `unsafe`; objc2 needs it for class definitions, message
+# sends with raw pointers and the C API, so this crate denies it and allows it
+# (with SAFETY comments) in the few modules that need it.
+[lints.rust]
+unsafe_code = "deny"
+
+[lints.clippy]
+pedantic = { level = "warn", priority = -1 }
+todo = "warn"
+unwrap_used = "warn"
+cast_possible_truncation = "allow"
+cast_possible_wrap = "allow"
+cast_sign_loss = "allow"
+cast_precision_loss = "allow"
+cast_lossless = "allow"
+module_name_repetitions = "allow"
+too_many_lines = "allow"
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+similar_names = "allow"
+struct_excessive_bools = "allow"
+fn_params_excessive_bools = "allow"
+match_same_arms = "allow"
+unreadable_literal = "allow"
+many_single_char_names = "allow"
+doc_markdown = "allow"
+must_use_candidate = "allow"
+return_self_not_must_use = "allow"
+used_underscore_binding = "allow"
+large_stack_arrays = "allow"
+inline_always = "allow"
+missing_safety_doc = "allow"
+
+# The AppKit code mirrors the Swift sources statement by statement (nested
+# `if let`s, `match` on bools, wildcard imports of the generated C enumerators).
+collapsible_if = "allow"
+collapsible_else_if = "allow"
+match_bool = "allow"
+wildcard_imports = "allow"
+unused_self = "allow"
+ref_as_ptr = "allow"
+ptr_cast_constness = "allow"
+redundant_closure_for_method_calls = "allow"
+manual_is_variant_and = "allow"
+semicolon_if_nothing_returned = "allow"
+
+[dev-dependencies]
+tempfile = "3"