refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-config/src/string.rs

@@ -75,58 +75,43 @@ fn parse_escape_sequence(bytes: &[u8], i: &mut usize) -> Option<u32> {
     Some(cp)
 }
 
-/// Parse a string literal into the original bytes (Zig `parse`'s output).
-/// `input` is a config string in the reversible OS-byte encoding; the result
-/// is decoded, so it can be written to the pty / OS directly.
-pub fn parse_bytes(input: &str) -> Result<Vec<u8>, StringError> {
-    parse(input).map(|s| ghostty_os::osbytes::config_str_to_bytes(&s))
-}
-
-/// Parse a string literal into a string. The string can contain
-/// any valid Zig string literal escape sequences.
-///
-/// The input and output are in the reversible OS-byte encoding (see
-/// `ghostty_os::osbytes`): bytes are copied through unchanged, and a
-/// code point produced by an escape is encoded as plain text, so a
-/// literal `U+FDD0` from `\u{fdd0}` stays distinct from the escape
-/// character. Use [`parse_bytes`] for the raw bytes.
-pub fn parse(bytes: &str) -> Result<String, StringError> {
-    let b = bytes.as_bytes();
-    let mut out = String::with_capacity(bytes.len());
+/// Parse literal escapes from the original bytes, copying unescaped bytes verbatim.
+/// Like Zig, \xFF denotes U+00FF; only unescaped bytes bypass UTF-8 validation.
+pub fn parse_bytes(input: impl AsRef<[u8]>) -> Result<Vec<u8>, StringError> {
+    let bytes = input.as_ref();
+    let mut out = Vec::with_capacity(bytes.len());
     let mut i = 0;
-    while i < b.len() {
-        if b[i] != b'\\' {
-            // Copy a whole UTF-8 character.
-            let ch = bytes[i..]
-                .chars()
-                .next()
-                .ok_or(StringError::InvalidString)?;
-            out.push(ch);
-            i += ch.len_utf8();
+    while i < bytes.len() {
+        if bytes[i] != b'\\' {
+            out.push(bytes[i]);
+            i += 1;
             continue;
         }
-
-        let cp = parse_escape_sequence(b, &mut i).ok_or(StringError::InvalidString)?;
-        // Surrogates cannot be encoded.
+        let cp = parse_escape_sequence(bytes, &mut i).ok_or(StringError::InvalidString)?;
         let ch = char::from_u32(cp).ok_or(StringError::InvalidString)?;
-        if ch == '\u{FDD0}' {
-            out.push_str("\u{FDD0}\u{FDD0}");
-        } else {
-            out.push(ch);
-        }
+        out.extend_from_slice(ch.encode_utf8(&mut [0; 4]).as_bytes());
     }
     Ok(out)
 }
 
+/// Plain-text convenience; byte consumers use [`parse_bytes`].
+pub fn parse(input: &str) -> Result<String, StringError> {
+    String::from_utf8(parse_bytes(input)?).map_err(|_| StringError::InvalidString)
+}
+
 /// Creates an iterator that requires no allocation to extract codepoints
 /// from the string literal, parsing escape sequences as it goes.
 #[must_use]
 pub fn codepoint_iterator(bytes: &str) -> CodepointIterator<'_> {
+    codepoint_iterator_bytes(bytes.as_bytes())
+}
+
+pub fn codepoint_iterator_bytes(bytes: &[u8]) -> CodepointIterator<'_> {
     CodepointIterator { bytes, i: 0 }
 }
 
 pub struct CodepointIterator<'a> {
-    bytes: &'a str,
+    bytes: &'a [u8],
     i: usize,
 }
 
@@ -136,19 +121,31 @@ impl CodepointIterator<'_> {
         if self.i >= self.bytes.len() {
             return Ok(None);
         }
-        if self.bytes.as_bytes()[self.i] == b'\\' {
+        if self.bytes[self.i] == b'\\' {
             // An escape sequence
-            return parse_escape_sequence(self.bytes.as_bytes(), &mut self.i)
+            return parse_escape_sequence(self.bytes, &mut self.i)
                 .map(Some)
                 .ok_or(StringError::InvalidString);
         }
 
         // Not an escape, parse as UTF-8
-        let ch = self.bytes[self.i..]
+        let len = match self.bytes[self.i] {
+            0..=0x7f => 1,
+            0xc2..=0xdf => 2,
+            0xe0..=0xef => 3,
+            0xf0..=0xf4 => 4,
+            _ => return Err(StringError::InvalidString),
+        };
+        let raw = self
+            .bytes
+            .get(self.i..self.i + len)
+            .ok_or(StringError::InvalidString)?;
+        let ch = std::str::from_utf8(raw)
+            .map_err(|_| StringError::InvalidString)?
             .chars()
             .next()
             .ok_or(StringError::InvalidString)?;
-        self.i += ch.len_utf8();
+        self.i += len;
         Ok(Some(u32::from(ch)))
     }
 }
@@ -157,17 +154,23 @@ impl CodepointIterator<'_> {
 #[allow(clippy::unwrap_used)]
 mod tests {
     #[test]
-    fn parse_bytes_decodes_the_reversible_encoding() {
+    fn parse_bytes_copies_original_bytes() {
         use ghostty_os::osbytes::EncodedOs;
 
         use super::{parse, parse_bytes};
 
         // Raw non-UTF-8 bytes pass through as the same bytes.
         let enc = EncodedOs::from_bytes(b"a\xffb\\n").into_encoded();
-        assert_eq!(parse_bytes(&enc).unwrap(), b"a\xffb\n");
+        assert_eq!(
+            parse_bytes(EncodedOs::from_encoded(enc).to_bytes()).unwrap(),
+            b"a\xffb\n"
+        );
         // A literal U+FDD0 (typed or via an escape) is that character.
         let lit = EncodedOs::from_plain_text("\u{fdd0}").into_encoded();
-        assert_eq!(parse_bytes(&lit).unwrap(), "\u{fdd0}".as_bytes());
+        assert_eq!(
+            parse_bytes(EncodedOs::from_encoded(lit).to_bytes()).unwrap(),
+            "\u{fdd0}".as_bytes()
+        );
         assert_eq!(parse_bytes("\\u{fdd0}").unwrap(), "\u{fdd0}".as_bytes());
         // An escape producing U+FF is the UTF-8 encoding, not byte FF.
         assert_eq!(parse_bytes("\\xff").unwrap(), "\u{ff}".as_bytes());