feat(core): port App/Surface and wire up the runnable ghostty binary

This is the integration step that turns the ported crates into a working
terminal: `cargo run` now opens a GTK window running the user's shell.

ghostty-core ports App.zig, Surface.zig (split into keyboard, mouse,
binding, clipboard and config submodules), surface_mouse.zig and
global.zig, and implements the runtime traits. perform_binding_action
handles every binding action.

Cross-crate integration:
- The core<->runtime traits (CoreApp, CoreSurface, RtApp, RtSurface,
  Waker) move from apprt-gtk into ghostty_apprt::runtime_api so the core
  stays runtime-agnostic; Scrollbar/RendererHealth stand-ins are replaced
  by the real terminal/renderer types.
- termio now uses ghostty_renderer::state::{State, SharedState}; the
  renderer calls kitty_update; image-storage-limit is applied at init
  and on config change.
- The search thread locks the terminal through a TerminalLock trait so
  it can share the render state mutex; termio's Wakeup gained a hook to
  wake the renderer thread.
- apprt-gtk: GL proc addresses are resolved through libepoxy's
  epoxy_glFoo pointer variables (plain glFoo symbols resolved to null),
  default DPI fixed to 96, libadwaita version read without GTK init so
  --version works headless.

The root binary dispatches +actions to ghostty-cli (list-fonts,
show-face and new-window are now wired) and otherwise runs the GTK app
with the real core.

Verified at runtime on Wayland and X11: shell prompt and colored output
render, child exit closes the window cleanly. Not yet verified: keyboard
and mouse input, clipboard, IME, tabs and splits (no key injection was
possible in this environment). GHOSTTY_DEBUG_SCREENSHOT=<png> dumps the
renderer's last frame for headless checks.

Test Plan:
- cargo test --workspace (2890 passed)
- cargo clippy --workspace --all-targets -- -D warnings
- GSETTINGS_BACKEND=memory GHOSTTY_RESOURCES_DIR=/usr/share/ghostty \
  cargo run

crates/ghostty-termio/src/state.rs

@@ -1,37 +1,49 @@
-//! The shared render state (`renderer/State.zig`, the part termio needs).
+//! The shared render state (`renderer/State.zig`).
 //!
-//! In Zig the terminal is owned by `Termio` and `renderer.State` holds a
-//! mutex plus a pointer to it. In Rust the terminal lives inside the mutex,
-//! shared via `Arc` between the IO thread, the pty read thread, the
-//! surface (core) thread and the renderer thread.
-//!
-//! TODO(integration): `renderer/State.zig` is deferred in ghostty-renderer;
-//! when it lands, this type should move there (and gain `inspector`,
-//! `preedit`, `mouse`).
+//! The canonical type lives in `ghostty-renderer`
+//! ([`ghostty_renderer::state::State`] behind a mutex,
+//! [`SharedState`]). This module only provides a convenience for termio:
+//! locking the state and borrowing just the [`Terminal`].
 
-use std::sync::{Mutex, MutexGuard, PoisonError};
+use std::ops::{Deref, DerefMut};
+use std::sync::{MutexGuard, PoisonError};
 
+pub use ghostty_renderer::state::{SharedState, State};
 use ghostty_terminal::terminal::Terminal;
 
-/// The state shared with the renderer.
-#[derive(Debug)]
-pub struct RendererState {
-    /// The terminal emulator state. Hold the lock for as short as possible;
-    /// it is contended by the pty read thread.
-    pub terminal: Mutex<Terminal>,
-}
+/// A locked [`SharedState`] that dereferences to its [`Terminal`].
+pub struct TerminalGuard<'a>(MutexGuard<'a, State>);
 
-impl RendererState {
-    pub fn new(terminal: Terminal) -> Self {
-        Self {
-            terminal: Mutex::new(terminal),
-        }
+impl TerminalGuard<'_> {
+    /// The whole locked state (preedit, mouse, ...).
+    pub fn state(&mut self) -> &mut State {
+        &mut self.0
     }
+}
 
-    /// Lock the terminal. Lock poisoning is ignored: a panic on another
-    /// thread must not take the whole terminal down with it (Zig mutexes
-    /// don't poison).
-    pub fn lock(&self) -> MutexGuard<'_, Terminal> {
-        self.terminal.lock().unwrap_or_else(PoisonError::into_inner)
+impl Deref for TerminalGuard<'_> {
+    type Target = Terminal;
+    fn deref(&self) -> &Terminal {
+        &self.0.terminal
+    }
+}
+
+impl DerefMut for TerminalGuard<'_> {
+    fn deref_mut(&mut self) -> &mut Terminal {
+        &mut self.0.terminal
+    }
+}
+
+/// Lock helpers for [`SharedState`].
+pub trait SharedStateExt {
+    /// Lock the state and borrow the terminal. Lock poisoning is ignored: a
+    /// panic on another thread must not take the whole terminal down with
+    /// it (Zig mutexes don't poison).
+    fn lock_terminal(&self) -> TerminalGuard<'_>;
+}
+
+impl SharedStateExt for SharedState {
+    fn lock_terminal(&self) -> TerminalGuard<'_> {
+        TerminalGuard(self.lock().unwrap_or_else(PoisonError::into_inner))
     }
 }