refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-vt-capi/src/osc.rs

@@ -6,7 +6,11 @@ use std::{
     ptr::NonNull,
 };
 
-use ghostty_vt::osc::{Command, Parser};
+use ghostty_vt::osc::{Command, Parser, color::RECORD_LEN};
+
+/// Records the color request list holds without growing (Zig:
+/// `SegmentedList(Request, 4)`).
+const COLOR_LIST_INLINE_RECORDS: usize = 4;
 
 use crate::{
     alloc::{Alloc, Allocator, CBlock, CByteStorage},
@@ -70,9 +74,16 @@ pub unsafe extern "C" fn ghostty_osc_new(
     let Some(storage) = CByteStorage::new(alloc, ghostty_vt::osc::MAX_BUF) else {
         return GhosttyResult::OutOfMemory;
     };
+    // Request lists of the color OSCs live in a second block from the same
+    // allocator (Zig: a `SegmentedList(Request, 4)` on the parser's
+    // allocator). Four inline records, like Zig, so short color commands
+    // never allocate after creation; longer lists grow via the allocator.
+    let Some(aux) = CByteStorage::new(alloc, COLOR_LIST_INLINE_RECORDS * RECORD_LEN) else {
+        return GhosttyResult::OutOfMemory;
+    };
     let Some(p) = alloc.create(OscParser {
         alloc,
-        parser: Parser::with_storage(storage),
+        parser: Parser::with_storage(storage, aux),
         command: OscCommand {
             key: 0,
             title_z: None,
@@ -320,6 +331,16 @@ mod tests {
                 ("66;s=2;hi", false),
                 ("3008;start=abc;type=shell", false),
                 ("5522;type=read;data", false),
+                // Color commands: the request lists live in the parser's
+                // storage, which comes from the caller's allocator.
+                ("4;1;rgb:ff/00/00;2;?", false),
+                ("5;0;rgb:00/00/00", false),
+                ("10;rgb:ff/ff/ff;?", false),
+                ("11;?", false),
+                ("104;1;2;3;4", false),
+                ("104", false),
+                ("112", false),
+                ("21;foreground=?;background=rgb:f0/f8/ff;cursor", false),
                 ("0;a title", true),
             ] {
                 ghostty_osc_reset(p);
@@ -346,6 +367,40 @@ mod tests {
         }
     }
 
+    #[test]
+    fn long_color_lists_grow_via_the_caller_allocator() {
+        let caller_allocs = AtomicUsize::new(0);
+        let a = Allocator {
+            ctx: (&raw const caller_allocs).cast_mut().cast(),
+            vtable: &raw const VT,
+        };
+        let mut p = std::ptr::null_mut();
+        // SAFETY: valid allocator and out pointer.
+        assert_eq!(
+            unsafe { ghostty_osc_new(&raw const a, &mut p) },
+            GhosttyResult::Success
+        );
+        // SAFETY: `p` is live for the whole block.
+        unsafe {
+            for osc in ["4;0;?;1;?;2;?;3;?;4;?;5;?", "21;1=?;2=?;3=?;4=?;5=?;6=?"] {
+                ghostty_osc_reset(p);
+                for b in osc.bytes() {
+                    ghostty_osc_next(p, b);
+                }
+                let global_before = global_allocs();
+                let caller_before = caller_allocs.load(Ordering::SeqCst);
+                let cmd = ghostty_osc_end(p, 0x07);
+                assert_ne!(ghostty_osc_command_type(cmd), 0, "{osc}");
+                assert_eq!(global_allocs(), global_before, "global allocation: {osc}");
+                assert!(
+                    caller_allocs.load(Ordering::SeqCst) > caller_before,
+                    "list did not grow through the caller allocator: {osc}"
+                );
+            }
+            ghostty_osc_free(p);
+        }
+    }
+
     fn new() -> *mut OscParser {
         let mut p = std::ptr::null_mut();
         // SAFETY: valid out pointer, default allocator.

crates/ghostty-vt-capi/tests/c/alloc_test.c

@@ -71,7 +71,7 @@ int main(void) {
     GhosttyAllocator a = {.ctx = &c, .vtable = &VT};
     GhosttyOscParser p;
     assert(ghostty_osc_new(&a, &p) == GHOSTTY_SUCCESS);
-    assert(c.allocs >= 2);            // the parser object and its buffer
+    assert(c.allocs >= 3);            // the parser object, its buffer and request storage
     assert(c.live >= 2048);           // the fixed payload buffer is ours
     feed(p, "0;hello", 7);
     GhosttyOscCommand cmd = ghostty_osc_end(p, 0x07);
@@ -88,7 +88,7 @@ int main(void) {
 
   // 2. Creation failure at each allocation point is OUT_OF_MEMORY and leaks
   //    nothing.
-  for (size_t fail_after = 0; fail_after < 2; fail_after++) {
+  for (size_t fail_after = 0; fail_after < 3; fail_after++) {
     Counter c = counter(0, fail_after);
     GhosttyAllocator a = {.ctx = &c, .vtable = &VT};
     GhosttyOscParser p = NULL;
@@ -175,6 +175,16 @@ int main(void) {
       {"9;4;1;50", GHOSTTY_OSC_COMMAND_CONEMU_PROGRESS_REPORT},
       {"22;pointer", GHOSTTY_OSC_COMMAND_MOUSE_SHAPE},
       {"66;s=2;hi", GHOSTTY_OSC_COMMAND_KITTY_TEXT_SIZING},
+      // Color commands keep their request lists in the parser's storage
+      // (the caller's allocator), up to 4 requests without growing.
+      {"4;1;rgb:ff/00/00;2;?", GHOSTTY_OSC_COMMAND_COLOR_OPERATION},
+      {"5;0;rgb:00/00/00", GHOSTTY_OSC_COMMAND_COLOR_OPERATION},
+      {"10;rgb:ff/ff/ff;?", GHOSTTY_OSC_COMMAND_COLOR_OPERATION},
+      {"11;?", GHOSTTY_OSC_COMMAND_COLOR_OPERATION},
+      {"104;1;2;3;4", GHOSTTY_OSC_COMMAND_COLOR_OPERATION},
+      {"104", GHOSTTY_OSC_COMMAND_COLOR_OPERATION},
+      {"112", GHOSTTY_OSC_COMMAND_COLOR_OPERATION},
+      {"21;foreground=?;background=rgb:f0/f8/ff;cursor", GHOSTTY_OSC_COMMAND_KITTY_COLOR_PROTOCOL},
     };
     Counter c = counter(0, SIZE_MAX);
     GhosttyAllocator a = {.ctx = &c, .vtable = &VT};
@@ -202,6 +212,35 @@ int main(void) {
     assert(c.allocs == c.frees);
   }
 
+  // 7. Longer color request lists grow through the caller's allocator (one
+  //    more block here), and fail like Zig's allocation failure (invalid
+  //    command) when the allocator refuses: the global allocator is never
+  //    used as a fallback.
+  {
+    static const char *const LONG4 = "4;0;?;1;?;2;?;3;?;4;?;5;?";
+    static const char *const LONG21 = "21;1=?;2=?;3=?;4=?;5=?;6=?";
+    for (int k = 0; k < 2; k++) {
+      const char *osc = k ? LONG21 : LONG4;
+      int type = k ? GHOSTTY_OSC_COMMAND_KITTY_COLOR_PROTOCOL : GHOSTTY_OSC_COMMAND_COLOR_OPERATION;
+      Counter c = counter(0, SIZE_MAX);
+      GhosttyAllocator a = {.ctx = &c, .vtable = &VT};
+      GhosttyOscParser p;
+      assert(ghostty_osc_new(&a, &p) == GHOSTTY_SUCCESS);
+      size_t base = c.allocs;
+      feed(p, osc, strlen(osc));
+      assert(ghostty_osc_command_type(ghostty_osc_end(p, 0x07)) == type);
+      assert(c.allocs > base);        // the list grew via the caller's allocator
+
+      ghostty_osc_reset(p);
+      c.fail_after = c.allocs;        // refuse any further allocation
+      feed(p, osc, strlen(osc));
+      assert(ghostty_osc_command_type(ghostty_osc_end(p, 0x07)) == GHOSTTY_OSC_COMMAND_INVALID);
+      ghostty_osc_free(p);
+      assert(c.live == 0);
+      assert(c.allocs == c.frees);
+    }
+  }
+
   puts("ok");
   return 0;
 }