refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-lib/src/benchmark.rs

@@ -7,27 +7,27 @@ use ghostty_bench::{args::Args, benches};
 
 /// Split the argument string like `std.process.ArgIteratorGeneral(.{})`:
 /// whitespace separated, with double quotes grouping and backslash
-/// escapes inside quotes.
-fn split_args(s: &str) -> Vec<String> {
+/// escapes inside quotes. Works on raw bytes: file names need not be UTF-8.
+fn split_args(s: &[u8]) -> Vec<std::ffi::OsString> {
     let mut out = Vec::new();
-    let mut cur = String::new();
+    let mut cur: Vec<u8> = Vec::new();
     let mut have = false;
     let mut in_quote = false;
-    let mut chars = s.chars().peekable();
-    while let Some(c) = chars.next() {
+    let mut bytes = s.iter().copied();
+    while let Some(c) = bytes.next() {
         match c {
-            '"' => {
+            b'"' => {
                 in_quote = !in_quote;
                 have = true;
             }
-            '\\' if in_quote => {
-                if let Some(n) = chars.next() {
+            b'\\' if in_quote => {
+                if let Some(n) = bytes.next() {
                     cur.push(n);
                 }
             }
-            c if c.is_whitespace() && !in_quote => {
+            c if c.is_ascii_whitespace() && !in_quote => {
                 if have {
-                    out.push(std::mem::take(&mut cur));
+                    out.push(ghostty_os::osbytes::os_from_bytes(std::mem::take(&mut cur)));
                     have = false;
                 }
             }
@@ -38,7 +38,7 @@ fn split_args(s: &str) -> Vec<String> {
         }
     }
     if have {
-        out.push(cur);
+        out.push(ghostty_os::osbytes::os_from_bytes(cur));
     }
     out
 }
@@ -62,7 +62,7 @@ pub unsafe extern "C" fn ghostty_benchmark_cli(
         log::warn!("unknown action={action}");
         return false;
     }
-    let argv = split_args(&args.to_string_lossy());
+    let argv = split_args(args.to_bytes());
     let parsed = match Args::parse(argv) {
         Ok(a) => a,
         Err(err) => {
@@ -85,9 +85,18 @@ mod tests {
 
     #[test]
     fn split_args_basic() {
-        assert_eq!(split_args("a b  c"), ["a", "b", "c"]);
-        assert_eq!(split_args("--x=\"a b\" c"), ["--x=a b", "c"]);
-        assert_eq!(split_args("   ").len(), 0);
+        assert_eq!(split_args(b"a b  c"), ["a", "b", "c"]);
+        assert_eq!(split_args(b"--x=\"a b\" c"), ["--x=a b", "c"]);
+        assert_eq!(split_args(b"   ").len(), 0);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn split_args_keeps_non_utf8_bytes() {
+        use std::os::unix::ffi::OsStrExt;
+        let v = split_args(b"--data=/tmp/a\xffb x");
+        assert_eq!(v[0].as_bytes(), b"--data=/tmp/a\xffb");
+        assert_eq!(v[1], "x");
     }
 
     #[test]