refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-renderer/src/generic.rs

@@ -200,7 +200,7 @@ enum HighlightTag {
 pub struct DerivedConfig {
     pub font_thicken: bool,
     pub font_thicken_strength: u8,
-    pub font_features: Vec<String>,
+    pub font_features: Vec<ghostty_os::osbytes::EncodedOs>,
     pub font_styles: [bool; 4],
     pub font_shaping_break: FontShapingBreak,
     pub cursor_color: Option<TerminalColor>,
@@ -243,10 +243,18 @@ impl DerivedConfig {
             .custom_shader
             .value
             .iter()
-            .map(|p| match p {
-                // Decode the config path (encoded OS string) here, once.
-                ConfigPath::Optional(s) => PathItem::Optional(s.to_path()),
-                ConfigPath::Required(s) => PathItem::Required(s.to_path()),
+            .filter_map(|p| {
+                let path = match p.path().to_path() {
+                    Ok(path) => path,
+                    Err(error) => {
+                        log::warn!("invalid shader path: {error}");
+                        return None;
+                    }
+                };
+                Some(match p {
+                    ConfigPath::Optional(_) => PathItem::Optional(path),
+                    ConfigPath::Required(_) => PathItem::Required(path),
+                })
             })
             .collect();
 
@@ -859,8 +867,13 @@ impl<G: GraphicsApi> DrawState<G> {
     fn prep_background_image(&mut self) {
         // Then we try to load the background image if we have a path.
         if let Some(p) = &self.config.bg_image
-            && let Some(image) =
-                load_background_image(&p.path().to_path()).map(image::Image::Pending)
+            && let Some(image) = p
+                .path()
+                .to_path()
+                .map_err(|error| log::warn!("invalid background image path: {error}"))
+                .ok()
+                .and_then(|path| load_background_image(&path))
+                .map(image::Image::Pending)
         {
             // If we have an existing background image, replace it.
             // Otherwise, set this as our background image directly.

crates/ghostty-renderer/src/link.rs

@@ -43,7 +43,7 @@ impl Set {
         let mut links = Vec::with_capacity(config.len());
         for link in config {
             links.push(Link {
-                regex: Regex::new(&ghostty_os::osbytes::config_str_to_text(&link.regex))?,
+                regex: Regex::new(&link.regex)?,
                 highlight: link.highlight,
             });
         }