refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-config/src/file_load.rs

@@ -159,7 +159,10 @@ impl std::error::Error for OpenFileError {}
 /// if it exists and is non-empty. This also constrains the possible
 /// errors to a smaller set that we can explicitly handle.
 pub fn open(path: &EncodedOs) -> Result<File, OpenFileError> {
-    let real = path.to_path();
+    let real = path.to_path().map_err(|err| {
+        log::warn!("invalid config path: {err}");
+        OpenFileError::FileOpenFailed
+    })?;
     assert!(real.is_absolute());
 
     let file = File::open(&real).map_err(|err| {
@@ -221,16 +224,16 @@ mod tests {
         std::fs::create_dir_all(&dir).unwrap();
         let new = EncodedOs::from_path(&dir.join("config.ghostty"));
         let legacy = EncodedOs::from_path(&dir.join("config"));
-        let _ = std::fs::remove_file(new.to_path());
-        let _ = std::fs::remove_file(legacy.to_path());
+        let _ = std::fs::remove_file(new.to_path().unwrap());
+        let _ = std::fs::remove_file(legacy.to_path().unwrap());
 
         // Neither exists: the new one.
         assert_eq!(preferred_of(new.clone(), legacy.clone()), new);
         // Only legacy exists: the legacy one.
-        std::fs::write(legacy.to_path(), "a=b").unwrap();
+        std::fs::write(legacy.to_path().unwrap(), "a=b").unwrap();
         assert_eq!(preferred_of(new.clone(), legacy.clone()), legacy);
         // Both exist: the new one.
-        std::fs::write(new.to_path(), "a=b").unwrap();
+        std::fs::write(new.to_path().unwrap(), "a=b").unwrap();
         assert_eq!(preferred_of(new.clone(), legacy.clone()), new);
         std::fs::remove_dir_all(&dir).unwrap();
     }
@@ -241,17 +244,17 @@ mod tests {
         std::fs::create_dir_all(&dir).unwrap();
         let app = EncodedOs::from_path(&dir.join("app"));
         let xdg_p = EncodedOs::from_path(&dir.join("xdg"));
-        let _ = std::fs::remove_file(app.to_path());
-        let _ = std::fs::remove_file(xdg_p.to_path());
+        let _ = std::fs::remove_file(app.to_path().unwrap());
+        let _ = std::fs::remove_file(xdg_p.to_path().unwrap());
         let xdg_fn = || Ok(xdg_p.clone());
 
         // Neither exists: app support.
         assert_eq!(preferred_macos(app.clone(), &xdg_fn).unwrap(), app);
         // XDG exists only: XDG.
-        std::fs::write(xdg_p.to_path(), "a=b").unwrap();
+        std::fs::write(xdg_p.to_path().unwrap(), "a=b").unwrap();
         assert_eq!(preferred_macos(app.clone(), &xdg_fn).unwrap(), xdg_p);
         // App support exists: app support wins.
-        std::fs::write(app.to_path(), "a=b").unwrap();
+        std::fs::write(app.to_path().unwrap(), "a=b").unwrap();
         assert_eq!(preferred_macos(app.clone(), &xdg_fn).unwrap(), app);
         std::fs::remove_dir_all(&dir).unwrap();
     }