refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-termio/src/command_windows.rs

@@ -50,8 +50,8 @@ use crate::windows_args::{self, create_windows_env_block, windows_create_command
 /// Errors from [`Command::start`].
 #[derive(Debug, thiserror::Error)]
 pub enum StartError {
-    #[error("malformed wtf-8 in a path, argument or environment value")]
-    InvalidWtf8(#[from] ghostty_os::osbytes::InvalidWtf8),
+    #[error("invalid utf-8 in a path, argument or environment value")]
+    InvalidUtf8(#[from] ghostty_os::osbytes::InvalidUtf8),
     #[error("string or environment is not valid unicode")]
     Encode(#[from] windows_args::EncodeError),
     #[error("windows error: {0}")]
@@ -132,14 +132,14 @@ impl Command {
     #[allow(unsafe_code)]
     pub fn start(&mut self) -> Result<(), StartError> {
         // `path` and `args` are the config command's argv strings (encoded
-        // OS strings); decode them to WTF-16 for the Windows API.
+        // OS strings); validate UTF-8 and convert to UTF-16 for the Windows API.
         // Like Zig's fallible `utf8ToUtf16Le*`, malformed input fails the
         // launch instead of selecting a U+FFFD-substituted path or argument.
-        let application_w = EncodedOs::from_encoded(&self.path).try_to_wide_nul()?;
+        let application_w = EncodedOs::from_encoded(&self.path).try_to_utf16_nul()?;
         let cwd_w = self
             .cwd
             .as_ref()
-            .map(EncodedOs::try_to_wide_nul)
+            .map(EncodedOs::try_to_utf16_nul)
             .transpose()?;
         let mut command_line_w = if self.args.is_empty() {
             None
@@ -147,7 +147,7 @@ impl Command {
             let wide: Vec<Vec<u16>> = self
                 .args
                 .iter()
-                .map(|a| EncodedOs::from_encoded(a).try_to_wide())
+                .map(|a| EncodedOs::from_encoded(a).try_to_utf16())
                 .collect::<Result<_, _>>()?;
             let mut line = windows_create_command_line_wide(&wide);
             line.push(0);