refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-apprt/src/action.rs

@@ -638,12 +638,12 @@ pub struct CellSize {
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct SetTitle {
-    pub title: String,
+    pub title: ghostty_os::osbytes::EncodedOs,
 }
 
 impl std::fmt::Display for SetTitle {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "SetTitle{{ {} }}", self.title)
+        write!(f, "SetTitle{{ {} }}", self.title.to_text_lossy())
     }
 }
 
@@ -657,7 +657,7 @@ pub struct Pwd {
 
 impl std::fmt::Display for Pwd {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "Pwd{{ {} }}", self.pwd.as_encoded())
+        write!(f, "Pwd{{ {} }}", self.pwd.to_text_lossy())
     }
 }
 
@@ -686,7 +686,7 @@ pub enum KeySequence {
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum KeyTable {
-    Activate(String),
+    Activate(ghostty_os::osbytes::EncodedOs),
     Deactivate,
     DeactivateAll,
 }

crates/ghostty-apprt/src/ipc.rs

@@ -29,7 +29,7 @@ pub struct NewWindow {
     /// shell should be launched.
     ///
     /// It is an error for this to be `Some`, but zero length.
-    pub arguments: Option<Vec<String>>,
+    pub arguments: Option<Vec<Vec<u8>>>,
 }
 
 /// IPC actions.

crates/ghostty-apprt/src/runtime_api.rs

@@ -291,7 +291,7 @@ pub trait RtSurface {
     fn close(&self, process_active: bool);
     /// Cgroup path of the surface (Linux, `gtk-single-instance` scopes).
     fn cgroup(&self) -> Option<String>;
-    fn get_title(&self) -> Option<String>;
+    fn get_title(&self) -> Option<ghostty_os::osbytes::EncodedOs>;
     fn get_content_scale(&self) -> ContentScale;
     fn get_size(&self) -> SurfaceSize;
     fn get_cursor_pos(&self) -> CursorPos;