refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-core/src/surface/clipboard.rs

@@ -409,21 +409,9 @@ impl Surface {
     }
 }
 
-/// The clipboard codepoint map with string replacements decoded from the
-/// config encoding (a literal `U+FDD0` is restored; bytes that are not
-/// UTF-8 can't be represented in the formatter's text output).
+/// Clipboard replacements are validated UTF-8 by the config field parser.
 fn decode_codepoint_map(list: &[formatter::CodepointMap]) -> Vec<formatter::CodepointMap> {
-    list.iter()
-        .map(|e| formatter::CodepointMap {
-            range: e.range,
-            replacement: match &e.replacement {
-                formatter::Replacement::String(s) => {
-                    formatter::Replacement::String(ghostty_os::osbytes::config_str_to_text(s))
-                }
-                r @ formatter::Replacement::Codepoint(_) => r.clone(),
-            },
-        })
-        .collect()
+    list.to_vec()
 }
 
 #[cfg(test)]
@@ -431,9 +419,8 @@ mod decode_map_tests {
     use super::*;
 
     #[test]
-    fn string_replacements_are_decoded() {
-        let enc = ghostty_os::osbytes::valid_str_to_config_string("a\u{fdd0}");
-        assert_ne!(enc, "a\u{fdd0}");
+    fn string_replacements_are_plain_text() {
+        let enc = "a\u{fdd0}".to_owned();
         let list = [formatter::CodepointMap {
             range: [1, 2],
             replacement: formatter::Replacement::String(enc),