refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-apprt-gtk/src/class/application.rs

@@ -78,7 +78,7 @@ pub enum QuitTimer {
 #[derive(Debug, Default, Clone)]
 pub struct WindowOverrides {
     pub command: Option<Command>,
-    pub working_directory: Option<String>,
+    pub working_directory: Option<ghostty_os::osbytes::EncodedOs>,
     pub title: Option<String>,
 }
 
@@ -1141,7 +1141,7 @@ impl Application {
     fn action_new_window(&self, parameter: Option<&glib::Variant>) {
         log::debug!("received new window action");
 
-        let mut working_directory: Option<String> = None;
+        let mut working_directory: Option<ghostty_os::osbytes::EncodedOs> = None;
         let mut title: Option<String> = None;
         let mut command: Option<Command> = None;
         let mut args: Vec<String> = Vec::new();
@@ -1180,7 +1180,9 @@ impl Application {
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--working-directory=") {
-                    working_directory = Some(v.trim().to_owned());
+                    // IPC carries the encoded form of the OS string.
+                    working_directory =
+                        Some(ghostty_os::osbytes::EncodedOs::from_encoded(v.trim()));
                     continue;
                 }
                 if let Some(v) = s.strip_prefix("--title=") {
@@ -1791,7 +1793,7 @@ impl Application {
             action::OpenUrlKind::Text => ghostty_os::open::OpenUrlKind::Text,
             action::OpenUrlKind::Html => ghostty_os::open::OpenUrlKind::Html,
         };
-        if let Err(err) = ghostty_os::open::open(kind, &value.url) {
+        if let Err(err) = ghostty_os::open::open(kind, &value.url.to_os()) {
             log::warn!("unable to open url: {err}");
         }
     }