fix: close the tail items from the targeted re-audit

Resolves the 13 rows still partial in docs/rewrite/notes/review-rv4-
codex.md (details in final-Z5.md):
- Escaped config strings are decoded to raw bytes at every OS boundary:
  Flatpak cwd/argv to D-Bus, screen-file paths, the default config
  template, GHOSTTY_RESOURCES_DIR/TERMINFO/shell integration/
  bindtextdomain consumers, custom shader loading, list-themes hyperlinks.
- osbytes escapes literal U+FDD0 on non-Unix too (bijective everywhere);
  the GTK paste dialog only decodes text that was actually encoded.
- shadertoy: whole-array uses of iChannelTime rebuild a plain float[4]
  from the std140-padded members (naga-validated, MSL offsets checked).
- libghostty-vt: the OSC parser holds caller-allocated storage inline
  and command payloads borrow from it, so ghostty_osc_end performs no
  global allocations (verified from Rust and C).
- crash: aarch64 Linux minidump context fixed; macOS fatal signals record
  siginfo, registers and a fault-safe stack walk.
- tripwire: selectionString map allocation-failure cleanup test ported.
- libghostty-vt emits the versioned soname libghostty-vt.so.0 at build
  time (no patchelf needed at install).

Test Plan:
- cargo test --workspace (3342 passed)
- just check-macos; just check-macos x86_64-apple-darwin;
  just check-windows; just check-wasm
- cargo check --target aarch64-unknown-linux-gnu -p ghostty-crash

crates/ghostty-vt-capi/tests/c/alloc_test.c

@@ -159,6 +159,49 @@ int main(void) {
     assert(c.live == 0);
   }
 
+  // 6. Ending an OSC copies no payload: with the allocator frozen after
+  //    creation (any allocation would fail), commands whose payloads are
+  //    borrowed from the parser's storage still parse, and every command
+  //    makes exactly the allocations the caller can see (none, except the
+  //    NUL-terminated title copy).
+  {
+    static const struct { const char *osc; int type; } cases[] = {
+      {"7;file:///tmp/x", GHOSTTY_OSC_COMMAND_REPORT_PWD},
+      {"8;id=a;https://example.com", GHOSTTY_OSC_COMMAND_HYPERLINK_START},
+      {"8;;", GHOSTTY_OSC_COMMAND_HYPERLINK_END},
+      {"52;c;aGVsbG8=", GHOSTTY_OSC_COMMAND_CLIPBOARD_CONTENTS},
+      {"133;A", GHOSTTY_OSC_COMMAND_SEMANTIC_PROMPT},
+      {"777;notify;title;body", GHOSTTY_OSC_COMMAND_SHOW_DESKTOP_NOTIFICATION},
+      {"9;4;1;50", GHOSTTY_OSC_COMMAND_CONEMU_PROGRESS_REPORT},
+      {"22;pointer", GHOSTTY_OSC_COMMAND_MOUSE_SHAPE},
+      {"66;s=2;hi", GHOSTTY_OSC_COMMAND_KITTY_TEXT_SIZING},
+    };
+    Counter c = counter(0, SIZE_MAX);
+    GhosttyAllocator a = {.ctx = &c, .vtable = &VT};
+    GhosttyOscParser p;
+    assert(ghostty_osc_new(&a, &p) == GHOSTTY_SUCCESS);
+    c.fail_after = c.allocs;          // freeze: no allocation may succeed
+    for (size_t i = 0; i < sizeof(cases) / sizeof(cases[0]); i++) {
+      size_t allocs = c.allocs;
+      ghostty_osc_reset(p);
+      feed(p, cases[i].osc, strlen(cases[i].osc));
+      GhosttyOscCommand cmd = ghostty_osc_end(p, 0x07);
+      assert(ghostty_osc_command_type(cmd) == cases[i].type);
+      assert(c.allocs == allocs);
+    }
+    // The title is the one payload handed to C: exactly one allocation.
+    c.fail_after = SIZE_MAX;
+    size_t allocs = c.allocs;
+    ghostty_osc_reset(p);
+    feed(p, "2;title", 7);
+    GhosttyOscCommand cmd = ghostty_osc_end(p, 0x07);
+    assert(ghostty_osc_command_type(cmd) == GHOSTTY_OSC_COMMAND_CHANGE_WINDOW_TITLE);
+    assert(c.allocs == allocs + 1);
+    ghostty_osc_free(p);
+    assert(c.live == 0);
+    assert(c.allocs == c.frees);
+  }
+
   puts("ok");
   return 0;
 }

crates/ghostty-vt-capi/tests/common/mod.rs

@@ -29,6 +29,9 @@ fn cargo() -> Command {
     Command::new(std::env::var_os("CARGO").unwrap_or_else(|| "cargo".into()))
 }
 
+/// Major version of libghostty-vt (the soname suffix set by build.rs).
+pub const VT_MAJOR: u32 = 0;
+
 static INSTALLED: OnceLock<PathBuf> = OnceLock::new();
 
 /// Build the cdylib/staticlib for the host and install them as
@@ -61,6 +64,19 @@ fn install_native_lib_once() -> PathBuf {
             std::fs::rename(&tmp, &dst).expect("install library");
         }
     }
+    // The cdylib's soname is versioned (`libghostty-vt.so.<major>`, see
+    // build.rs), so executables linked against it need that name at run time
+    // (otherwise the loader would fall back to an unrelated system copy).
+    let so = dir.join("libghostty-vt.so");
+    if so.exists() {
+        let versioned = dir.join(format!("libghostty-vt.so.{VT_MAJOR}"));
+        let tmp = dir.join(format!(
+            "libghostty-vt.so.{VT_MAJOR}.{}.tmp",
+            std::process::id()
+        ));
+        std::fs::copy(&so, &tmp).expect("install versioned library");
+        std::fs::rename(&tmp, &versioned).expect("install versioned library");
+    }
     dir
 }
 

crates/ghostty-vt-capi/tests/soname.rs

@@ -0,0 +1,29 @@
+//! The shared library must carry the versioned soname `libghostty-vt.so.<major>`
+//! straight from the build (Zig sets `.version` on the shared library), not
+//! via a post-install `patchelf` step.
+#![cfg(target_os = "linux")]
+#![allow(clippy::unwrap_used)]
+
+mod common;
+
+use std::process::Command;
+
+#[test]
+fn shared_library_has_versioned_soname() {
+    let lib = common::install_native_lib();
+    let so = lib.join("libghostty-vt.so");
+    let Ok(out) = Command::new("readelf").arg("-d").arg(&so).output() else {
+        eprintln!("readelf not available; skipping");
+        return;
+    };
+    let text = String::from_utf8_lossy(&out.stdout);
+    let want = format!("[libghostty-vt.so.{}]", common::VT_MAJOR);
+    assert!(
+        text.lines()
+            .any(|l| l.contains("SONAME") && l.contains(&want)),
+        "expected SONAME {want}:\n{text}"
+    );
+    // build.rs is the single source of the version (install-lib.sh reads it).
+    let build_rs = std::fs::read_to_string(common::manifest_dir().join("build.rs")).unwrap();
+    assert!(build_rs.contains(&format!("const VT_VERSION: &str = \"{}.", common::VT_MAJOR)));
+}