refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-termio/src/windows_args.rs

@@ -90,6 +90,48 @@ pub fn windows_create_command_line<S: AsRef<str>>(argv: &[S]) -> String {
     buf
 }
 
+/// [`windows_create_command_line`] over UTF-16 arguments (which may hold
+/// lone surrogates, so they cannot be a `str`). The quoting rules are the
+/// same: only ASCII characters are significant, so the logic is identical on
+/// code units.
+pub fn windows_create_command_line_wide(argv: &[Vec<u16>]) -> Vec<u16> {
+    let (sp, tab, nl, quote, bs) = (
+        u16::from(b' '),
+        u16::from(b'\t'),
+        u16::from(b'\n'),
+        u16::from(b'"'),
+        u16::from(b'\\'),
+    );
+    let mut buf: Vec<u16> = Vec::new();
+    for (arg_i, arg) in argv.iter().enumerate() {
+        if arg_i != 0 {
+            buf.push(sp);
+        }
+        if !arg.iter().any(|c| [sp, tab, nl, quote].contains(c)) {
+            buf.extend_from_slice(arg);
+            continue;
+        }
+        buf.push(quote);
+        let mut backslash_count = 0usize;
+        for &c in arg {
+            if c == bs {
+                backslash_count += 1;
+            } else if c == quote {
+                buf.extend(std::iter::repeat_n(bs, backslash_count * 2 + 1));
+                buf.push(quote);
+                backslash_count = 0;
+            } else {
+                buf.extend(std::iter::repeat_n(bs, backslash_count));
+                buf.push(c);
+                backslash_count = 0;
+            }
+        }
+        buf.extend(std::iter::repeat_n(bs, backslash_count * 2));
+        buf.push(quote);
+    }
+    buf
+}
+
 /// The argv for a `shell` command on Windows (`execCommand`): the command is
 /// run as `%WINDIR%\System32\cmd.exe /C <command>`.
 pub fn windows_shell_args(windir: &str, command: &str) -> Vec<String> {
@@ -115,6 +157,25 @@ mod tests {
         windows_create_command_line(args)
     }
 
+    #[test]
+    fn wide_command_line_matches_str_version_and_keeps_lone_surrogates() {
+        let w = |s: &str| s.encode_utf16().collect::<Vec<u16>>();
+        for args in [
+            vec!["a", "b c", "d\"e", "f\\", "g h\\"],
+            vec!["cmd.exe", "/C", "echo \"hi\" there"],
+        ] {
+            let wide: Vec<Vec<u16>> = args.iter().map(|a| w(a)).collect();
+            assert_eq!(
+                windows_create_command_line_wide(&wide),
+                w(&windows_create_command_line(&args))
+            );
+        }
+        // A lone surrogate inside a quoted argument is carried unchanged.
+        let lone = vec![u16::from(b'a'), u16::from(b' '), 0xD800];
+        let out = windows_create_command_line_wide(&[lone]);
+        assert_eq!(out, [34, 97, 32, 0xD800, 34]);
+    }
+
     #[test]
     fn shell_args_use_windir_cmd() {
         assert_eq!(