refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-config/src/theme.rs

@@ -37,7 +37,7 @@ impl Location {
             .ok(),
             Location::Resources => {
                 let base = resources_dir?;
-                Some(EncodedOs::from_path(&base.to_path().join("themes")))
+                Some(EncodedOs::from_path(&base.to_path().ok()?.join("themes")))
             }
         }
     }
@@ -157,7 +157,13 @@ pub fn open(
     resources_dir: Option<&EncodedOs>,
     diags: &mut DiagnosticList,
 ) -> Option<OpenedTheme> {
-    let theme_path = theme.to_path();
+    let theme_path = match theme.to_path() {
+        Ok(path) => path,
+        Err(error) => {
+            diag(diags, format!("failed to load theme: {error}"));
+            return None;
+        }
+    };
     let theme_text = theme.as_encoded();
 
     // Absolute themes are loaded a different path.
@@ -190,8 +196,8 @@ pub fn open(
     // one that exists.
     let mut it = LocationIterator::new(resources_dir);
     while let Some((_, dir)) = it.next_location() {
-        let path = EncodedOs::from_path(&dir.to_path().join(theme.to_os()));
-        match File::open(path.to_path()) {
+        let path = EncodedOs::from_path(&dir.to_path().ok()?.join(&theme_path));
+        match path.to_path().and_then(File::open) {
             Ok(file) => {
                 if !check_regular(&file, theme_text, diags) {
                     return None;
@@ -218,7 +224,7 @@ pub fn open(
     // our iterator, reiterate over in order to build a better error message.
     it.reset();
     while let Some((_, dir)) = it.next_location() {
-        let path = EncodedOs::from_path(&dir.to_path().join(theme.to_os()));
+        let path = EncodedOs::from_path(&dir.to_path().ok()?.join(&theme_path));
         diag(
             diags,
             format!(
@@ -235,8 +241,9 @@ pub fn open(
 /// then messages will be appended to the given error list and None is
 /// returned.
 pub fn open_absolute(theme: &EncodedOs, diags: &mut DiagnosticList) -> Option<File> {
+    let path = theme.to_path();
     let theme = theme.as_encoded();
-    match File::open(EncodedOs::from_encoded(theme).to_path()) {
+    match path.and_then(File::open) {
         Ok(f) => Some(f),
         Err(err) => {
             if err.kind() == std::io::ErrorKind::NotFound {