fix(config): match Zig's numeric grammar, NUL handling and diagnostics

Resolves the 6 differential gap groups in docs/rewrite/notes/review-
rv9-codex.md (details in final-Z11.md):
- ghostty_os::zig_fmt ports std.fmt.parseInt/parseUnsigned/parseFloat
  (underscores, 0x/0o/0b prefixes, hex floats, inf/nan) with the Zig std
  tests and replaces every int/float parse in config, keybind
  parameters, ssh-cache and desktop detection.
- Interior NUL no longer panics in font names and ends C strings like
  Zig's backing bytes (fontconfig, C config getters, title actions,
  clipboard callback, relative paths, config-file, shaders, background
  image, GTK CSS).
- GTK new-window arguments are trimmed of ASCII whitespace only.
- Command tokenization uses a port of std.process.ArgIteratorGeneral
  (incl. CR/LF separators) with its std tests.
- UTF-8 validation happens where Zig's field parsers do it, so error
  kinds match (metric modifiers, quick-terminal size, link, ...).

A scripted differential run of 202 fields x ~220 hostile/valid values
against /usr/bin/ghostty (+validate-config and +show-config: exit code,
stdout, stderr) now has zero mismatches besides build-specific defaults
(theme resources path, auto-update-channel, gtk-opengl-debug); it also
surfaced and fixed background-blur failure state, NaN formatting and
NaN/-0 finalize clamps. Regression tests: ghostty-config/tests/
zig_parity.rs.

Test Plan:
- cargo test --workspace --no-fail-fast (3456 passed, exit 0)
- just check-macos (both), just check-windows, just check-wasm

crates/ghostty-lib/src/action_c.rs

@@ -34,16 +34,15 @@ pub struct Keep {
 }
 
 impl Keep {
-    /// A NUL terminated copy of `s` (interior NULs are dropped).
+    /// A NUL terminated copy of `s` (it ends at the first interior NUL).
     fn cstr(&mut self, s: &str) -> *const c_char {
         self.cstr_bytes(s.as_bytes())
     }
 
     /// [`Keep::cstr`] for raw bytes.
     fn cstr_bytes(&mut self, s: &[u8]) -> *const c_char {
-        let mut s = s.to_vec();
-        s.retain(|&b| b != 0);
-        let c = CString::new(s).unwrap_or_default();
+        let end = s.iter().position(|&b| b == 0).unwrap_or(s.len());
+        let c = CString::new(&s[..end]).unwrap_or_default();
         let ptr = c.as_ptr();
         // The heap buffer of a CString doesn't move when the Vec grows.
         self.strings.push(c);
@@ -241,6 +240,26 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn c_title_actions_end_at_the_first_interior_nul() {
+        use ghostty_os::osbytes::EncodedOs;
+        let mut keep = Keep::default();
+        for tab in [false, true] {
+            let title = SetTitle {
+                title: EncodedOs::from_bytes(b"a\0b"),
+            };
+            let action = if tab {
+                Action::SetTabTitle(title)
+            } else {
+                Action::SetTitle(title)
+            };
+            let c = action_to_c(&action, &mut keep);
+            // SAFETY: both title union members have identical layout, pointer owned by keep.
+            let title = unsafe { std::ffi::CStr::from_ptr(c.action.set_title.title) };
+            assert_eq!(title.to_bytes(), b"a");
+        }
+    }
+
     #[test]
     fn c_title_actions_and_key_table_names_forward_original_bytes() {
         use ghostty_os::osbytes::EncodedOs;

crates/ghostty-lib/src/config_capi.rs

@@ -98,18 +98,23 @@ impl CConfig {
     }
 }
 
-/// A C string without interior NULs.
+/// A C string over `bytes` that ends at the first NUL, like a C consumer
+/// reading Zig's backing bytes (the rest is never visible through the pointer).
+fn cstring_until_nul(bytes: &[u8]) -> CString {
+    let end = bytes.iter().position(|&b| b == 0).unwrap_or(bytes.len());
+    CString::new(&bytes[..end]).unwrap_or_default()
+}
+
+/// A C string for a UTF-8 string, ending at the first NUL.
 fn cstring(s: &str) -> CString {
-    CString::new(s.replace('\0', "")).unwrap_or_default()
+    cstring_until_nul(s.as_bytes())
 }
 
 /// A C string for a config *value*: config strings carry non-UTF-8 bytes in
 /// the reversible [`ghostty_os::osbytes`] encoding, so the embedder gets the
 /// decoded bytes (Zig hands out the original byte slice).
 fn cstring_value(s: &str) -> CString {
-    let mut bytes = ghostty_os::osbytes::config_str_to_bytes(s);
-    bytes.retain(|b| *b != 0);
-    CString::new(bytes).unwrap_or_default()
+    cstring_until_nul(&ghostty_os::osbytes::config_str_to_bytes(s))
 }
 
 /// Intern a string for the lifetime of the process (enum tag names).
@@ -614,6 +619,23 @@ mod tests {
         assert_eq!(b.strings[0].to_str().unwrap(), "h\u{e9}llo");
     }
 
+    #[test]
+    fn config_string_values_end_at_the_first_interior_nul() {
+        use ghostty_os::osbytes::EncodedOs;
+        let enc = EncodedOs::from_bytes(b"a\0b");
+        let b = build_backing(&CValue::String(enc.into_encoded()));
+        assert_eq!(b.strings[0].as_bytes(), b"a");
+        let b = build_backing(&CValue::String("x\0y".to_owned()));
+        assert_eq!(b.strings[0].as_bytes(), b"x");
+        let enc = EncodedOs::from_bytes(b"\0lead");
+        let b = build_backing(&CValue::Path {
+            path: enc.into_encoded(),
+            optional: false,
+        });
+        assert_eq!(b.strings[0].as_bytes(), b"");
+        assert_eq!(intern("ab\0c"), intern("ab"));
+    }
+
     fn get<T: Copy>(cfg: ghostty_config_t, key: &str, init: T) -> (bool, T) {
         let mut out = init;
         // SAFETY: `out` is a valid destination of the key's C type.

crates/ghostty-lib/src/embedded.rs

@@ -626,9 +626,8 @@ impl RtSurface for SurfaceRt {
             .iter()
             .map(|(m, d)| {
                 (
-                    CString::new(m.replace('\0', "")).unwrap_or_default(),
-                    CString::new(d.iter().copied().filter(|b| *b != 0).collect::<Vec<u8>>())
-                        .unwrap_or_default(),
+                    nul_terminated_prefix(m.as_bytes()),
+                    nul_terminated_prefix(d),
                 )
             })
             .collect();
@@ -2157,6 +2156,13 @@ mod darwin {
     }
 }
 
+/// A C string that ends at the first interior NUL, like a C consumer of a
+/// Zig sentinel-terminated slice.
+fn nul_terminated_prefix(bytes: &[u8]) -> CString {
+    let end = bytes.iter().position(|&b| b == 0).unwrap_or(bytes.len());
+    CString::new(&bytes[..end]).unwrap_or_default()
+}
+
 #[cfg(test)]
 mod tests {
     use std::os::unix::ffi::OsStrExt;