refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-apprt-gtk/src/class/application.rs

@@ -401,10 +401,7 @@ impl Application {
         // Keep the inherited bytes: LANG need not be UTF-8.
         let saved_language = std::env::var_os("LANG");
         if let Some(language) = &config.language {
-            set_env(
-                "LANG",
-                ghostty_os::osbytes::EncodedOs::from_encoded(language.clone()).to_os(),
-            );
+            set_env("LANG", language.to_os());
         }
 
         // Set gettext global domain to be our app so that our unqualified
@@ -447,7 +444,9 @@ impl Application {
 
         // Our app ID determines uniqueness and maps to our desktop file.
         let app_id: String = match &config.class {
-            Some(class) if gio::Application::id_is_valid(class) => class.clone(),
+            Some(class) if gio::Application::id_is_valid(&class.to_text_lossy()) => {
+                class.to_text_lossy()
+            }
             Some(_) => {
                 log::warn!("invalid 'class' in config, ignoring");
                 crate::APPLICATION_ID.to_owned()
@@ -1102,7 +1101,7 @@ impl Application {
         let mut working_directory: Option<ghostty_os::osbytes::EncodedOs> = None;
         let mut title: Option<String> = None;
         let mut command: Option<Command> = None;
-        let mut args: Vec<String> = Vec::new();
+        let mut args: Vec<ghostty_os::osbytes::EncodedOs> = Vec::new();
 
         'overrides: {
             // were we given a parameter?
@@ -1121,7 +1120,7 @@ impl Application {
                 log::debug!("new-window argument: {i} {s}");
 
                 if e_seen {
-                    args.push(s.clone());
+                    args.push(ghostty_os::osbytes::EncodedOs::from_plain_text(s));
                     continue;
                 }
                 if s == "-e" {
@@ -1138,9 +1137,9 @@ impl Application {
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--working-directory=") {
-                    // IPC carries the encoded form of the OS string.
+                    // D-Bus strings are plain UTF-8, including literal U+FDD0.
                     working_directory =
-                        Some(ghostty_os::osbytes::EncodedOs::from_encoded(v.trim()));
+                        Some(ghostty_os::osbytes::EncodedOs::from_plain_text(v.trim()));
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--title=") {
@@ -1449,7 +1448,7 @@ impl Application {
                 true
             }
             Action::SetTitle(v) => {
-                tgt.with_surface_void("set_title", |s| s.set_title(Some(&v.title)));
+                tgt.with_surface_void("set_title", |s| s.set_title(Some(&v.title.to_text_lossy())));
                 true
             }
             Action::SetTabTitle(v) => {
@@ -1462,11 +1461,8 @@ impl Application {
                         log::warn!("surface is not in a tab, ignoring set_tab_title");
                         return false;
                     };
-                    tab.set_title_override(if v.title.is_empty() {
-                        None
-                    } else {
-                        Some(&v.title)
-                    });
+                    let title = v.title.to_text_lossy();
+                    tab.set_title_override(if title.is_empty() { None } else { Some(&title) });
                     true
                 })
             }