refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-font/src/shaper/coretext.rs

@@ -74,12 +74,17 @@ pub enum ShapeRunError {
 
 /// Create a CoreFoundation Dictionary suitable for settings the font
 /// features of a CoreText font (`makeFeaturesDict`).
-fn make_features_dict(feats: &[Feature]) -> CfBox<CFDictionary> {
+fn make_features_dict(feats: &[Feature]) -> Result<CfBox<CFDictionary>, ShapeError> {
     let mut items: Vec<CFRetained<CFDictionary<CFString, CFType>>> = Vec::new();
 
     for feat in feats {
         // Keys can only be ASCII.
-        let key = CFString::from_str(&String::from_utf8_lossy(&feat.tag));
+        if !feat.tag.is_ascii() {
+            return Err(ShapeError::CoreTextFailed);
+        }
+        let key = CFString::from_str(
+            std::str::from_utf8(&feat.tag).map_err(|_| ShapeError::CoreTextFailed)?,
+        );
         let value = CFNumber::new_i32(feat.value as i32);
 
         // SAFETY: valid static keys.
@@ -98,7 +103,9 @@ fn make_features_dict(feats: &[Feature]) -> CfBox<CFDictionary> {
     let k = unsafe { kCTFontFeatureSettingsAttribute };
     let dict = CFDictionary::<CFString, CFType>::from_slices(&[k], &[list.as_ref()]);
     // SAFETY: the attribute dictionary is used as an untyped CFDictionary.
-    CfBox::new(unsafe { CFRetained::cast_unchecked::<CFDictionary>(dict) })
+    Ok(CfBox::new(unsafe {
+        CFRetained::cast_unchecked::<CFDictionary>(dict)
+    }))
 }
 
 /// Shaper that uses CoreText.
@@ -146,7 +153,7 @@ impl Shaper {
     pub fn new(opts: &shape::Options) -> Result<Shaper, ShapeError> {
         let mut feature_list = FeatureList::default();
         for feature_str in &opts.features {
-            feature_list.append_from_string(feature_str);
+            feature_list.append_from_bytes(&feature_str.to_bytes());
         }
 
         // We need to construct two attrs dictionaries for font features;
@@ -155,8 +162,8 @@ impl Shaper {
         let mut feats_df: Vec<Feature> = DEFAULT_FEATURES.to_vec();
         feats_df.extend_from_slice(feats);
 
-        let features = make_features_dict(&feats_df);
-        let features_no_default = make_features_dict(feats);
+        let features = make_features_dict(&feats_df)?;
+        let features_no_default = make_features_dict(feats)?;
 
         // For now we only support LTR text. If we shape RTL text then
         // rendering will be very wrong so we need to explicitly force