fix: close the RV6 verification gaps

Resolves the 7 gap groups in docs/rewrite/notes/review-rv6-codex.md
(final-Z8.md):
- crash (macOS): request_abort_dump returns false on mach_msg receive
  timeout/error so the signal-path fallback runs; EXC_SOFT_SIGNAL keeps
  the signal number in the minidump exception info.
- Default SHELL read as an OS string and stored in encoded command form.
- macOS executable search works on raw PATH bytes; the default path is
  used only when PATH is unset.
- Windows: config env overrides are decoded; EnvMap compares keys as
  WTF-16 units with per-unit Unicode simple uppercasing (no lossy
  conversion, distinct lone-surrogate keys stay distinct).
- +show-config writes original bytes for encoded OS data, so export +
  reload round-trips; UTF-8 configs are byte-identical as before.
- Zig's ensureLocale chain lives in ghostty-os for all Unix targets and
  is used by both the GTK app and the C API init.

Also makes the quick-terminal GTK replay test independent of compositor
focus: GTK's is-active is read-only, so when niri actually focuses the
layer surface the simulated focus-out cannot drive autohide and that
assertion is skipped (the production logic is unchanged and matches Zig).

Test Plan:
- cargo test --workspace (3390 passed, incl. tests/gtk_replay.rs)
- just check-macos (both), just check-windows, just check-wasm

crates/ghostty-crash/src/mach_handler.rs

@@ -460,7 +460,7 @@ pub(crate) fn request_abort_dump(signo: libc::c_int) -> bool {
     // suspension before replying). Bounded, in case the dump hangs.
     let mut buf = Buffer([0; 1024]);
     // SAFETY: `buf` is a writable 1024 byte aligned buffer.
-    unsafe {
+    let received = unsafe {
         mach_msg(
             buf.0.as_mut_ptr().cast(),
             MACH_RCV_MSG | MACH_RCV_TIMEOUT,
@@ -469,9 +469,11 @@ pub(crate) fn request_abort_dump(signo: libc::c_int) -> bool {
             reply,
             ABORT_WAIT_MS,
             MACH_PORT_NULL,
-        );
-    }
-    true
+        )
+    };
+    // Timeout or error: the report was not confirmed, so the caller falls
+    // back to the signal-path report.
+    exception::abort_reply_ok(received)
 }
 
 fn write_report(
@@ -508,7 +510,7 @@ fn write_report(
         exception: Some(ExceptionInfo {
             kind: ex.kind,
             code: ex.code as u64,
-            subcode: (ex.kind == exception::EXC_BAD_ACCESS).then_some(ex.subcode as u64),
+            subcode: ex.minidump_subcode(),
         }),
     };
     let dump = MinidumpWriter::with_crash_context(cc).dump(&mut Cursor::new(Vec::new()));