refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-os/src/flatpak.rs

@@ -1,3 +1,12 @@
+/// GLib's g_variant_new_string substitutes the entire invalid value (Zig's {ss}).
+fn glib_env_string(value: &std::ffi::OsStr) -> String {
+    let bytes = crate::osbytes::os_bytes(value);
+    let bytes = bytes.split(|b| *b == 0).next().unwrap_or_default();
+    std::str::from_utf8(bytes)
+        .unwrap_or("[Invalid UTF-8]")
+        .to_owned()
+}
+
 use std::{
     collections::HashMap,
     os::fd::{AsFd, OwnedFd},
@@ -147,12 +156,7 @@ impl FlatpakHostCommand {
                 .env
                 .iter()
                 .flat_map(crate::env::EnvMap::iter)
-                .map(|(k, v)| {
-                    (
-                        k.to_string_lossy().into_owned(),
-                        v.to_string_lossy().into_owned(),
-                    )
-                })
+                .map(|(k, v)| (glib_env_string(k), glib_env_string(v)))
                 .collect(),
             fds: [
                 self.stdin
@@ -491,3 +495,20 @@ mod tests {
         assert_eq!(((3u32 << 8) >> 8) & 0xff, 3);
     }
 }
+
+#[cfg(test)]
+mod byte_string_tests {
+    #[test]
+    fn glib_env_replaces_the_whole_invalid_value() {
+        use crate::osbytes::EncodedOs;
+        assert_eq!(
+            super::glib_env_string(&EncodedOs::from_bytes(b"before\xffafter").to_os()),
+            "[Invalid UTF-8]"
+        );
+        let literal = "x\u{fdd0}é";
+        assert_eq!(
+            super::glib_env_string(std::ffi::OsStr::new(literal)),
+            literal
+        );
+    }
+}