refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-config/src/comma_splitter.rs

@@ -54,21 +54,31 @@ enum UnicodeState {
 #[derive(Debug, Clone)]
 pub struct CommaSplitter<'a> {
     /// the string that we are splitting
-    str: &'a str,
+    str: &'a [u8],
     /// how much of the string has been consumed so far
     index: usize,
 }
 
 impl<'a> CommaSplitter<'a> {
+    pub fn new(value: &'a str) -> Self {
+        Self::from_bytes(value.as_bytes())
+    }
+
+    pub fn next_field(&mut self) -> Result<Option<&'a str>, Error> {
+        self.next_bytes()?
+            .map(|b| std::str::from_utf8(b).map_err(|_| Error::IllegalEscape))
+            .transpose()
+    }
+
     /// initialize a splitter with the given string
     #[must_use]
-    pub fn new(str: &'a str) -> Self {
+    pub fn from_bytes(str: &'a [u8]) -> Self {
         Self { str, index: 0 }
     }
 
     /// return the next field, `Ok(None)` if no more fields
-    pub fn next_field(&mut self) -> Result<Option<&'a str>, Error> {
-        let bytes = self.str.as_bytes();
+    pub fn next_bytes(&mut self) -> Result<Option<&'a [u8]>, Error> {
+        let bytes = self.str;
         if self.index >= bytes.len() {
             return Ok(None);
         }
@@ -213,7 +223,7 @@ impl<'a> CommaSplitter<'a> {
         }
         let r = &self.str[self.index..];
         self.index = self.str.len();
-        Some(r)
+        std::str::from_utf8(r).ok()
     }
 }