refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-font/src/deferred_face.rs

@@ -69,10 +69,11 @@ impl DeferredFace {
             .expect("deferred face has no fontconfig data");
 
         // Filename and index for our face so we can load it
-        let filename = fc.pattern.get_string(fc::Property::File, 0)?;
+        // File names are raw OS bytes, not text.
+        let filename = fc.pattern.get_os_string(fc::Property::File, 0)?;
         let face_index = fc.pattern.get_integer(fc::Property::Index, 0)?;
 
-        let mut face = Face::init_file(lib, &filename, face_index, opts)?;
+        let mut face = Face::init_file(lib, std::path::Path::new(&filename), face_index, opts)?;
         face.set_variations(&fc.variations, opts)?;
         Ok(face)
     }

crates/ghostty-font/src/face/freetype.rs

@@ -131,11 +131,13 @@ impl Face {
     /// Initialize a new font face from a file.
     pub fn init_file(
         lib: &Library,
-        path: &str,
+        path: impl AsRef<std::path::Path>,
         index: i32,
         opts: Options,
     ) -> Result<Face, FaceError> {
-        let cpath = CString::new(path).map_err(|_| FaceError::InvalidPath)?;
+        // File names are raw OS bytes (they need not be UTF-8).
+        let cpath = CString::new(path.as_ref().as_os_str().as_encoded_bytes())
+            .map_err(|_| FaceError::InvalidPath)?;
         let face = {
             let _g = lib.lock();
             ft::FtFace::new_file(&lib.inner.lib, &cpath, index).map_err(FaceError::Freetype)?

crates/ghostty-font/src/fontconfig.rs

@@ -186,6 +186,11 @@ impl Pattern {
     }
 
     pub fn add_string(&mut self, prop: Property, v: &str) -> bool {
+        self.add_string_bytes(prop, v.as_bytes())
+    }
+
+    /// [`Pattern::add_string`] for arbitrary bytes (file names).
+    pub fn add_string_bytes(&mut self, prop: Property, v: &[u8]) -> bool {
         let Ok(c) = CString::new(v) else {
             return false;
         };
@@ -205,8 +210,31 @@ impl Pattern {
         unsafe { sys::FcPatternAddCharSet(self.as_ptr(), prop.cstr().as_ptr(), cs.0.as_ptr()) != 0 }
     }
 
-    /// Get the string value at index `id`.
+    /// Get the string value at index `id` as the raw OS string. Use this for
+    /// file names: they are arbitrary bytes, not necessarily UTF-8.
+    pub fn get_os_string(&self, prop: Property, id: u32) -> Result<std::ffi::OsString, Error> {
+        let bytes = self.get_string_bytes(prop, id)?;
+        #[cfg(unix)]
+        {
+            use std::os::unix::ffi::OsStringExt;
+            Ok(std::ffi::OsString::from_vec(bytes))
+        }
+        #[cfg(not(unix))]
+        {
+            Ok(std::ffi::OsString::from(
+                String::from_utf8_lossy(&bytes).into_owned(),
+            ))
+        }
+    }
+
+    /// Get the string value at index `id` as text. Only for properties that
+    /// fontconfig defines as UTF-8 (family/style/full names); invalid bytes
+    /// are replaced. File names use [`Pattern::get_os_string`].
     pub fn get_string(&self, prop: Property, id: u32) -> Result<String, Error> {
+        Ok(String::from_utf8_lossy(&self.get_string_bytes(prop, id)?).into_owned())
+    }
+
+    fn get_string_bytes(&self, prop: Property, id: u32) -> Result<Vec<u8>, Error> {
         let mut out: *mut sys::FcChar8 = ptr::null_mut();
         // SAFETY: valid pattern; out is a valid out pointer.
         let r = unsafe {
@@ -223,7 +251,7 @@ impl Pattern {
         }
         // SAFETY: fontconfig returned a NUL-terminated string owned by the pattern.
         let s = unsafe { CStr::from_ptr(out.cast()) };
-        Ok(s.to_string_lossy().into_owned())
+        Ok(s.to_bytes().to_vec())
     }
 
     pub fn get_integer(&self, prop: Property, id: u32) -> Result<i32, Error> {
@@ -420,6 +448,22 @@ mod tests {
         assert!(!emoji.has_lang("en-US"));
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn file_name_keeps_non_utf8_bytes() {
+        use std::os::unix::ffi::OsStrExt;
+        let mut p = Pattern::create();
+        assert!(p.add_string_bytes(Property::File, b"/fonts/a\xffb.ttf"));
+        let f = p.get_os_string(Property::File, 0).unwrap();
+        assert_eq!(f.as_bytes(), b"/fonts/a\xffb.ttf");
+        // The text accessor is for UTF-8 names only and is lossy.
+        assert!(
+            p.get_string(Property::File, 0)
+                .unwrap()
+                .contains('\u{fffd}')
+        );
+    }
+
     #[test]
     fn charset_add_has() {
         let mut cs = CharSet::create();