refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-font/src/discovery.rs

@@ -37,10 +37,10 @@ mod fc_impl {
     pub fn to_fc_pattern(desc: &Descriptor) -> fc::Pattern {
         let mut pat = fc::Pattern::create();
         if let Some(family) = &desc.family {
-            assert!(pat.add_string(fc::Property::Family, family));
+            assert!(pat.add_string_bytes(fc::Property::Family, &family.to_bytes()));
         }
         if let Some(style) = &desc.style {
-            assert!(pat.add_string(fc::Property::Style, style));
+            assert!(pat.add_string_bytes(fc::Property::Style, &style.to_bytes()));
         }
         if desc.codepoint > 0 {
             let mut cs = fc::CharSet::create();
@@ -162,6 +162,43 @@ mod fc_impl {
 mod tests {
     use super::*;
 
+    #[cfg(font_fontconfig)]
+    #[test]
+    fn configured_font_names_reach_fontconfig_as_original_bytes() {
+        use ghostty_config::config::Config;
+        use ghostty_os::osbytes::os_bytes;
+
+        use crate::fontconfig::Property;
+        let mut config = Config::default();
+        config
+            .parse_field("font-family", Some("Family\u{fdd0}é"))
+            .unwrap();
+        config
+            .parse_field("font-style", Some("Style\u{fdd0}é"))
+            .unwrap();
+        config
+            .parse_field_bytes("font-codepoint-map", Some(b"U+0041=Family\xff"))
+            .unwrap();
+        let pat = to_fc_pattern(&Descriptor {
+            family: Some(config.font_family.list[0].clone()),
+            style: config.font_style.name_value().cloned(),
+            ..Descriptor::default()
+        });
+        assert_eq!(
+            os_bytes(&pat.get_os_string(Property::Family, 0).unwrap()),
+            "Family\u{fdd0}é".as_bytes()
+        );
+        assert_eq!(
+            os_bytes(&pat.get_os_string(Property::Style, 0).unwrap()),
+            "Style\u{fdd0}é".as_bytes()
+        );
+        let pat = to_fc_pattern(&config.font_codepoint_map.map.list[0].descriptor);
+        assert_eq!(
+            os_bytes(&pat.get_os_string(Property::Family, 0).unwrap()),
+            b"Family\xff"
+        );
+    }
+
     #[test]
     fn descriptor_hash() {
         let d = Descriptor::default();