refactor(config): parse config values from raw bytes like Zig

Zig parses config values (cli/args.zig, Config.zig field parsers,
config/string.zig) from raw byte slices, and each field type decides
whether it requires UTF-8 (InvalidValue otherwise) or stores bytes. The
port escape-encoded raw bytes into Strings at the line reader and let
fields parse the escaped text, so fields could observe encoding
artifacts; successive audits kept finding such leaks (RV5-RV8).

Field parsers now receive the original bytes: text fields validate UTF-8
where Zig does, byte/path fields store bytes (EncodedOs/OsString). This
resolves all 9 RV8 findings (docs/rewrite/notes/review-rv8-codex.md),
each with a regression test: Windows path conversion fails with
BadPathName instead of substituting U+FFFD; Windows process launch uses
strict UTF-8 like Zig's Command; the WTF-8 decoder accepts paired-
surrogate encodings like Zig; literal U+FDD0 Unicode key triggers;
selection-word-chars and clipboard-codepoint-map reject invalid UTF-8;
font style / codepoint-map family names use original bytes; C title
actions forward bytes; D-Bus new-window/Flatpak conversions match Zig.
Design, sweep and validation: docs/rewrite/notes/final-bytes-refactor.md.

Also moves the bundled iTerm2-Color-Schemes license out of
resources/themes/ so +list-themes no longer lists it as a theme
(output is now byte-identical to Ghostty 1.3.1).

Done by Codex (gpt-6-astra), reviewed and verified by the orchestrator.

Test Plan:
- cargo test --workspace --no-fail-fast (3428 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm
- +show-config --default --docs, +list-keybinds, +list-actions --docs,
  +list-themes --plain compared with /usr/bin/ghostty

crates/ghostty-termio/src/windows_args.rs

@@ -15,21 +15,11 @@ pub enum EncodeError {
     InvalidUtf8,
 }
 
-/// Convert an OS string to UTF-16 code units. On Windows this is lossless
-/// (`encode_wide`); elsewhere the string must be valid UTF-8.
+/// Zig's Windows Command validates UTF-8, including inherited environment strings.
+/// An unpaired UTF-16 surrogate in an OS string is therefore an error.
 pub fn os_str_to_utf16(s: &OsStr) -> Result<Vec<u16>, EncodeError> {
-    #[cfg(windows)]
-    {
-        use std::os::windows::ffi::OsStrExt;
-        Ok(s.encode_wide().collect())
-    }
-    #[cfg(not(windows))]
-    {
-        Ok(s.to_str()
-            .ok_or(EncodeError::InvalidUtf8)?
-            .encode_utf16()
-            .collect())
-    }
+    ghostty_os::osbytes::try_utf8_to_wide(&ghostty_os::osbytes::os_bytes(s))
+        .map_err(|_| EncodeError::InvalidUtf8)
 }
 
 /// Create a UTF-16 environment block for `CreateProcessW` with
@@ -157,6 +147,19 @@ mod tests {
         windows_create_command_line(args)
     }
 
+    #[test]
+    fn inherited_environment_rejects_non_utf8() {
+        let bad = ghostty_os::osbytes::EncodedOs::from_wide(&[0xd800]).to_os();
+        assert_eq!(
+            create_windows_env_block([(std::ffi::OsStr::new("KEY"), bad.as_os_str())]),
+            Err(EncodeError::InvalidUtf8)
+        );
+        assert_eq!(
+            create_windows_env_block([(bad.as_os_str(), std::ffi::OsStr::new("value"))]),
+            Err(EncodeError::InvalidUtf8)
+        );
+    }
+
     #[test]
     fn wide_command_line_matches_str_version_and_keeps_lone_surrogates() {
         let w = |s: &str| s.encode_utf16().collect::<Vec<u16>>();