fix: close the tail items from the targeted re-audit

Resolves the 13 rows still partial in docs/rewrite/notes/review-rv4-
codex.md (details in final-Z5.md):
- Escaped config strings are decoded to raw bytes at every OS boundary:
  Flatpak cwd/argv to D-Bus, screen-file paths, the default config
  template, GHOSTTY_RESOURCES_DIR/TERMINFO/shell integration/
  bindtextdomain consumers, custom shader loading, list-themes hyperlinks.
- osbytes escapes literal U+FDD0 on non-Unix too (bijective everywhere);
  the GTK paste dialog only decodes text that was actually encoded.
- shadertoy: whole-array uses of iChannelTime rebuild a plain float[4]
  from the std140-padded members (naga-validated, MSL offsets checked).
- libghostty-vt: the OSC parser holds caller-allocated storage inline
  and command payloads borrow from it, so ghostty_osc_end performs no
  global allocations (verified from Rust and C).
- crash: aarch64 Linux minidump context fixed; macOS fatal signals record
  siginfo, registers and a fault-safe stack walk.
- tripwire: selectionString map allocation-failure cleanup test ported.
- libghostty-vt emits the versioned soname libghostty-vt.so.0 at build
  time (no patchelf needed at install).

Test Plan:
- cargo test --workspace (3342 passed)
- just check-macos; just check-macos x86_64-apple-darwin;
  just check-windows; just check-wasm
- cargo check --target aarch64-unknown-linux-gnu -p ghostty-crash

crates/ghostty-os/src/env.rs

@@ -203,6 +203,14 @@ pub fn append_env_always(current: &str, value: &str) -> String {
     format!("{current}{DELIMITER}{value}")
 }
 
+/// Byte-preserving [`append_env_always`].
+pub fn append_env_always_os(current: &OsStr, value: &OsStr) -> OsString {
+    let mut out = current.to_owned();
+    out.push(DELIMITER.to_string());
+    out.push(value);
+    out
+}
+
 /// Byte-preserving [`prepend_env`].
 pub fn prepend_env_os(current: &OsStr, value: &OsStr) -> OsString {
     if current.is_empty() {

crates/ghostty-os/src/flatpak.rs

@@ -296,6 +296,14 @@ impl FlatpakSignalHandle {
     }
 }
 
+/// Decode a reversible config string to the original bytes plus NUL, the
+/// D-Bus `ay` form of a path/argument.
+fn nul_terminated_bytes(s: &str) -> Vec<u8> {
+    let mut v = crate::osbytes::config_str_to_bytes(s);
+    v.push(0);
+    v
+}
+
 struct Request {
     argv: Vec<String>,
     cwd: Option<String>,
@@ -346,22 +354,26 @@ fn start(
         .argv
         .iter()
         .map(|a| {
-            let mut v = a.as_bytes().to_vec();
+            let mut v = crate::osbytes::config_str_to_bytes(a);
             v.push(0);
             v
         })
         .collect();
 
     // Get the cwd in case we don't have ours set.
-    let cwd = match request.cwd {
-        Some(c) => c,
-        None => std::env::current_dir()
-            .map_err(|_| Error::FlatpakSetupFail)?
-            .to_string_lossy()
-            .into_owned(),
+    // D-Bus `ay`: the original bytes (request.cwd carries the reversible
+    // config-string encoding).
+    let cwd = if let Some(c) = request.cwd {
+        nul_terminated_bytes(&c)
+    } else {
+        let mut v = crate::osbytes::os_bytes(
+            std::env::current_dir()
+                .map_err(|_| Error::FlatpakSetupFail)?
+                .as_os_str(),
+        );
+        v.push(0);
+        v
     };
-    let mut cwd = cwd.into_bytes();
-    cwd.push(0);
 
     // Subscribe to exit notifications (before the call so we can't miss it).
     let rule = MatchRule::builder()
@@ -429,6 +441,13 @@ fn wait_for_exit(shared: &Shared, iter: MessageIterator, pid: u32) {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn dbus_bytes_are_decoded() {
+        let enc = crate::osbytes::bytes_to_config_string(b"/tmp/\xff\xfe");
+        assert_ne!(enc.as_bytes(), b"/tmp/\xff\xfe");
+        assert_eq!(super::nul_terminated_bytes(&enc), b"/tmp/\xff\xfe\0");
+    }
+
     use super::*;
 
     #[test]

crates/ghostty-os/src/i18n.rs

@@ -1,6 +1,3 @@
-#[cfg(not(windows))]
-use std::path::Path;
-
 use crate::i18n_locales::LOCALES;
 
 /// Application bundle ID, used as the gettext domain
@@ -42,16 +39,18 @@ pub fn init(resources_dir: &str) -> Result<(), InitError> {
     // is standard for translations.
     // (`std.fs.path.dirname` returns null for a bare relative name, where
     // `Path::parent` returns an empty path.)
-    let share_dir = Path::new(resources_dir)
+    let resources_dir = crate::osbytes::config_str_to_path(resources_dir);
+    let share_dir = resources_dir
         .parent()
         .filter(|p| !p.as_os_str().is_empty())
         .ok_or(InitError::InvalidResourcesDir)?;
 
     // Build our locale path
-    let path = format!("{}/locale", share_dir.display());
+    let path = share_dir.join("locale");
 
-    // Bind our bundle ID to the given locale path
-    log::debug!("binding domain={BUNDLE_ID} path={path}");
+    // Bind our bundle ID to the given locale path (gettextrs takes a
+    // `Into<PathBuf>`, so non-UTF-8 bytes are preserved).
+    log::debug!("binding domain={BUNDLE_ID} path={}", path.display());
     gettextrs::bindtextdomain(BUNDLE_ID, path).map_err(|_| InitError::OutOfMemory)?;
     Ok(())
 }

crates/ghostty-os/src/osbytes.rs

@@ -100,10 +100,18 @@ pub fn os_to_config_string(s: &OsStr) -> String {
     }
     #[cfg(not(unix))]
     {
-        s.to_string_lossy().into_owned()
+        valid_str_to_config_string(&s.to_string_lossy())
     }
 }
 
+/// Encode a string that is already valid UTF-8 (e.g. the WTF-8 to UTF-8
+/// conversion of a non-Unix OS string). The only thing that needs escaping is
+/// a literal escape character, so decoding stays a bijection on every
+/// platform. Shared (not cfg gated) so it is testable everywhere.
+pub fn valid_str_to_config_string(s: &str) -> String {
+    bytes_to_config_string(s.as_bytes())
+}
+
 /// Inverse of [`os_to_config_string`].
 pub fn config_str_to_os(s: &str) -> OsString {
     os_from_bytes(config_str_to_bytes(s))
@@ -142,6 +150,17 @@ mod tests {
         assert_eq!(config_str_to_bytes(icons), icons.as_bytes());
     }
 
+    #[test]
+    fn valid_str_encoder_escapes_literal_escape_char() {
+        // Shared logic of the non-Unix encoder: U+FDD0 U+00FF must not be
+        // mistaken for the escape of byte 0xFF.
+        let s = "a\u{fdd0}\u{ff}";
+        let e = valid_str_to_config_string(s);
+        assert_eq!(e, "a\u{fdd0}\u{fdd0}\u{ff}");
+        assert_eq!(config_str_to_bytes(&e), s.as_bytes());
+        assert_eq!(valid_str_to_config_string("plain"), "plain");
+    }
+
     #[test]
     fn literal_escape_char_is_doubled() {
         let s = "a\u{fdd0}\u{ff}";