refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-font/src/discovery_coretext.rs

@@ -71,7 +71,9 @@ pub fn to_coretext_descriptor(
 
     // Family
     if let Some(family) = &desc.family {
-        let family = CFString::from_str(family);
+        let family = CFString::from_str(
+            std::str::from_utf8(&family.to_bytes()).map_err(|_| DiscoverError::DescriptorFailed)?,
+        );
         // SAFETY: valid static key.
         keys.push(unsafe { kCTFontFamilyNameAttribute });
         values.push(as_type(&*family));
@@ -79,7 +81,9 @@ pub fn to_coretext_descriptor(
 
     // Style
     if let Some(style) = &desc.style {
-        let style = CFString::from_str(style);
+        let style = CFString::from_str(
+            std::str::from_utf8(&style.to_bytes()).map_err(|_| DiscoverError::DescriptorFailed)?,
+        );
         // SAFETY: valid static key.
         keys.push(unsafe { kCTFontStyleNameAttribute });
         values.push(as_type(&*style));
@@ -414,7 +418,11 @@ fn score(desc: &Descriptor, ct_desc: &CTFontDescriptor) -> Score {
     // The first string in this slice will be used for the exact match,
     // and for the fuzzy match, all matching substrings will increase
     // the rank.
-    let desired_styles = math::desired_styles(desc.style.as_deref(), desc.bold, desc.italic);
+    let style = desc
+        .style
+        .as_ref()
+        .map(ghostty_os::osbytes::EncodedOs::to_text_lossy);
+    let desired_styles = math::desired_styles(style.as_deref(), desc.bold, desc.italic);
     let (exact, fuzzy) = math::style_scores(&style_str, &desired_styles);
     this.exact_style = exact;
     this.fuzzy_style = fuzzy;