test(core): add headless end-to-end tests and fix bugs they found

Adds crates/ghostty-core/tests/e2e_*.rs: 81 tests that drive the real
core Surface, termio, pty and child processes through a fake runtime
(recording apprt actions, in-memory clipboard) with a headless renderer
(ghostty-renderer/src/headless.rs). They cover keys (legacy, DECCKM,
kitty, modifyOtherKeys), keybinding actions and sequences, mouse
selection/reporting/scrolling/links, clipboard incl. OSC 52 and paste
safety, resize, focus, titles/pwd/bell/notifications/progress, child
exit, and IME preedit.

Fixes for issues found by the tests and by the Codex audit
(docs/rewrite/notes/review-core-codex.md, all 9 items):
- replacing a selection with copy-on-select panicked (stale tracked
  handles); global new_window no longer inherits a parent; the child
  environment uses the runtime's env wholesale so GTK's removals stick;
  Flatpak host resources path; locale recovery (ensureLocale) in
  apprt-gtk before GTK init and for CLI actions; failed screen-file
  opens propagate errors; OSC 52 base64 rules, CSI/ESC binding length
  limits and GHOSTTY_LOG parsing match Zig.
- Also includes V2's termio cleanups (tmux viewer wiring in the stream
  handler, Pty slave semantics docs, shared cgroup wait loop).

apprt-gtk gains a debug input replay hook (GHOSTTY_DEBUG_INPUT_SCRIPT)
exercising the real GTK key path. With it, the real app was verified on
Wayland: typing and output, new tab, splits, select-all/copy/paste and
font size all work (docs/rewrite/notes/verification-V1.md). Not yet
exercised at GTK level: mouse, real IM-context IME, clipboard dialogs.

Test Plan:
- cargo test --workspace (2983 passed)
- cargo test -p ghostty-core --tests (81 e2e tests)

crates/ghostty-apprt-gtk/src/key.rs

@@ -101,11 +101,19 @@ pub fn keyval_unicode_unshifted(
     event: &gdk::KeyEvent,
     keycode: u32,
 ) -> u32 {
-    let display = widget.as_ref().display();
-
     // We need the currently active keyboard layout so we know what group to
     // look at.
-    let layout = event.layout();
+    keyval_unicode_unshifted_for_layout(widget, event.layout(), keycode)
+}
+
+/// Like [`keyval_unicode_unshifted`] with an explicit keyboard layout (group)
+/// instead of a `GdkKeyEvent`; used by the debug input replay.
+pub fn keyval_unicode_unshifted_for_layout(
+    widget: &impl IsA<gtk::Widget>,
+    layout: u32,
+    keycode: u32,
+) -> u32 {
+    let display = widget.as_ref().display();
 
     // All possible keyboard mappings for this keycode (the physical key).
     let Some(entries) = display.map_keycode(keycode) else {
@@ -132,10 +140,25 @@ pub fn event_mods(
     action: Action,
     winproto_event_mods: impl FnOnce(Option<&gdk::Device>, gdk::ModifierType) -> Mods,
 ) -> Mods {
-    let device = event.device();
+    event_mods_for_device(
+        event.device().as_ref(),
+        physical_key,
+        gtk_mods,
+        action,
+        winproto_event_mods,
+    )
+}
 
-    let mut mods = winproto_event_mods(device.as_ref(), gtk_mods);
-    mods.num_lock = device.as_ref().is_some_and(DeviceExt::is_num_locked);
+/// Like [`event_mods`] but with the (optional) device instead of the event.
+pub fn event_mods_for_device(
+    device: Option<&gdk::Device>,
+    physical_key: K,
+    gtk_mods: gdk::ModifierType,
+    action: Action,
+    winproto_event_mods: impl FnOnce(Option<&gdk::Device>, gdk::ModifierType) -> Mods,
+) -> Mods {
+    let mut mods = winproto_event_mods(device, gtk_mods);
+    mods.num_lock = device.is_some_and(DeviceExt::is_num_locked);
 
     // We use the physical key to determine sided modifiers. As far as I can
     // tell there's no other way to reliably determine this.