fix: systematic byte fidelity for config strings and RV7 gaps

Resolves the 9 gap groups in docs/rewrite/notes/review-rv7-codex.md and
audits every string-typed config field against its consumers
(field -> consumers -> decode status table in final-Z9.md):
- Windows EnvMap keys use a port of Zig's nls.zig uppercase table
  (upcaseW); Windows locale init follows Zig's chain (setlocale +
  _putenv_s); malformed WTF-8 now fails process launch conversions like
  Zig instead of substituting U+FFFD; kitty file paths convert WTF-8.
- bash --rcfile/--init-file, configured TERM and inherited GTK LANG
  keep their original bytes.
- C API clipboard completion and ghostty_surface_binding_action take
  bytes; complete_clipboard_request is byte-typed through the core.
- text:/csi:/esc: bindings, enquiry-response, input = path:, embedded
  initial_input, search needles, titles, link regexes, clipboard
  codepoint map, command palette text and GTK font/namespace values
  decode the escape encoding before use.

Remaining by design: D-Bus a{ss} values and +new-window arguments are
UTF-8 by D-Bus type. C API key/preedit text follows separately.

Test Plan:
- cargo test --workspace
- just check-macos (both), just check-windows, just check-wasm

crates/ghostty-apprt-gtk/examples/demo.rs

@@ -203,7 +203,7 @@ impl CoreSurface for DemoSurface {
     fn complete_clipboard_request(
         &self,
         _req: ClipboardRequest,
-        data: &str,
+        data: &[u8],
         _confirmed: bool,
     ) -> Result<(), ClipboardError> {
         log::info!("demo: paste of {} bytes", data.len());

crates/ghostty-apprt-gtk/src/class/application.rs

@@ -87,11 +87,11 @@ pub struct WindowOverrides {
 
 /// Set an environment variable.
 #[allow(unsafe_code)]
-fn set_env(key: &str, value: &str) {
+fn set_env(key: &str, value: impl AsRef<std::ffi::OsStr>) {
     // SAFETY: only called during application construction on the main
     // thread, before GTK is initialized and before we spawn any child
     // processes; no other thread in this crate reads the environment.
-    unsafe { std::env::set_var(key, value) }
+    unsafe { std::env::set_var(key, value.as_ref()) }
 }
 
 /// Funnel GLib/GObject/GTK log messages into the `log` crate rather than
@@ -284,7 +284,7 @@ mod imp {
         pub css: RefCell<Option<CssProviders>>,
 
         /// Copy of the LANG variable provided by the system, if any.
-        pub saved_language: RefCell<Option<String>>,
+        pub saved_language: RefCell<Option<std::ffi::OsString>>,
     }
 
     #[glib::object_subclass]
@@ -398,9 +398,13 @@ impl Application {
             }
         };
 
-        let saved_language = std::env::var("LANG").ok();
+        // Keep the inherited bytes: LANG need not be UTF-8.
+        let saved_language = std::env::var_os("LANG");
         if let Some(language) = &config.language {
-            set_env("LANG", language);
+            set_env(
+                "LANG",
+                ghostty_os::osbytes::EncodedOs::from_encoded(language.clone()).to_os(),
+            );
         }
 
         // Set gettext global domain to be our app so that our unqualified
@@ -560,7 +564,7 @@ impl Application {
     }
 
     /// The original `LANG` Ghostty was launched with (None if unset).
-    pub fn saved_language(&self) -> Option<String> {
+    pub fn saved_language(&self) -> Option<std::ffi::OsString> {
         self.imp().saved_language.borrow().clone()
     }
 

crates/ghostty-apprt-gtk/src/class/command_palette.rs

@@ -110,7 +110,9 @@ mod command_imp {
         fn prop_get_title(&self) -> Option<String> {
             let mut data = self.data.borrow_mut();
             match &mut *data {
-                CommandData::Regular { command } => Some(command.title.clone()),
+                CommandData::Regular { command } => {
+                    Some(ghostty_os::osbytes::config_str_to_text(&command.title))
+                }
                 CommandData::Jump { surface, title, .. } => {
                     if let Some(t) = title {
                         return Some(t.clone());
@@ -125,7 +127,9 @@ mod command_imp {
         fn prop_get_description(&self) -> Option<String> {
             let mut data = self.data.borrow_mut();
             match &mut *data {
-                CommandData::Regular { command } => Some(command.description.clone()),
+                CommandData::Regular { command } => Some(ghostty_os::osbytes::config_str_to_text(
+                    &command.description,
+                )),
                 CommandData::Jump {
                     surface,
                     description,

crates/ghostty-apprt-gtk/src/class/surface.rs

@@ -180,6 +180,16 @@ impl Default for Surface {
 // ---------------------------------------------------------------------
 // Construction / lookup
 
+/// Restore the `LANG` the application was launched with (as bytes; it need
+/// not be UTF-8), or remove it if it was unset.
+fn restore_language(env: &mut ghostty_os::EnvMap, saved: Option<&std::ffi::OsStr>) {
+    if let Some(language) = saved {
+        env.insert("LANG", language);
+    } else {
+        env.remove("LANG");
+    }
+}
+
 impl Surface {
     /// Create a new surface widget (Zig: `Surface.new`).
     pub fn new(overrides: SurfaceOverrides) -> Self {
@@ -1441,11 +1451,7 @@ impl Surface {
         // Byte-preserving environment (Zig `internal_os.getEnvMap`).
         let mut env = ghostty_os::env::get_env_map();
 
-        if let Some(language) = application.saved_language() {
-            env.insert("LANG", language);
-        } else {
-            env.remove("LANG");
-        }
+        restore_language(&mut env, application.saved_language().as_deref());
 
         // Don't leak these GTK environment variables to child processes.
         env.remove("GDK_DEBUG");
@@ -2610,7 +2616,7 @@ mod clipboard {
             };
 
             let Some(core) = this.core() else { return };
-            match core.complete_clipboard_request(state, &text, false) {
+            match core.complete_clipboard_request(state, text.as_bytes(), false) {
                 Ok(()) => {}
                 Err(ClipboardError::UnsafePaste | ClipboardError::UnauthorizedPaste) => {
                     show_clipboard_confirmation(&this, state, &text, false);
@@ -2636,7 +2642,7 @@ mod clipboard {
         }
 
         let Some(core) = surface.core() else { return };
-        match core.complete_clipboard_request(ClipboardRequest::Paste, text, false) {
+        match core.complete_clipboard_request(ClipboardRequest::Paste, text.as_bytes(), false) {
             Ok(()) => {}
             Err(ClipboardError::UnsafePaste | ClipboardError::UnauthorizedPaste) => {
                 show_clipboard_confirmation(surface, ClipboardRequest::Paste, text, false);
@@ -2725,7 +2731,7 @@ mod clipboard {
                 // Undo the byte escape only for non-UTF-8 pastes.
                 core.complete_paste_bytes(&confirmed_paste_bytes(&text, encoded), true)
             } else {
-                core.complete_clipboard_request(req, &text, true)
+                core.complete_clipboard_request(req, text.as_bytes(), true)
             };
             if let Err(err) = result {
                 log::warn!("failed to complete clipboard request: {err}");
@@ -3379,7 +3385,11 @@ mod imp {
         fn search_changed(_overlay: &SearchOverlay, needle: Option<String>, this: &super::Surface) {
             let Some(surface) = this.core() else { return };
             if let Err(err) = surface.perform_binding_action(
-                &ghostty_input::binding::Action::Search(needle.unwrap_or_default()),
+                // Binding payloads are config strings: the needle is plain
+                // UI text, so escape it instead of decoding it.
+                &ghostty_input::binding::Action::Search(
+                    ghostty_os::osbytes::valid_str_to_config_string(&needle.unwrap_or_default()),
+                ),
             ) {
                 log::warn!("unable to perform search action err={err}");
             }
@@ -3908,6 +3918,20 @@ mod imp {
 mod tests {
     use super::*;
 
+    #[test]
+    #[allow(clippy::unwrap_used)]
+    fn inherited_lang_keeps_non_utf8_bytes() {
+        use std::os::unix::ffi::{OsStrExt, OsStringExt};
+
+        let mut env = ghostty_os::EnvMap::new();
+        env.insert("LANG", "zz");
+        let saved = std::ffi::OsString::from_vec(b"C\xff".to_vec());
+        restore_language(&mut env, Some(&saved));
+        assert_eq!(env.get("LANG").unwrap().as_bytes(), b"C\xff");
+        restore_language(&mut env, None);
+        assert!(env.get("LANG").is_none());
+    }
+
     #[test]
     fn confirmed_paste_decodes_only_encoded_text() {
         // Ordinary text containing the escape char + U+00FF stays intact.

crates/ghostty-apprt-gtk/src/class/window.rs

@@ -313,7 +313,7 @@ mod imp {
                 // so that any applications inspecting the window states see
                 // an immediate title set when the window appears.
                 if let Some(title) = &config.title {
-                    obj.set_title(Some(title));
+                    obj.set_title(Some(&ghostty_os::osbytes::config_str_to_text(title)));
                 }
             }
 

crates/ghostty-apprt-gtk/src/css.rs

@@ -215,6 +215,7 @@ pub fn runtime_css(config: &Config, gtk_416: bool) -> String {
     }
 
     if let Some(family) = &config.window_title_font_family {
+        let family = ghostty_os::osbytes::config_str_to_text(family);
         let _ = write!(
             out,
             ".window headerbar {{\n  font-family: \"{family}\";\n}}\n"

crates/ghostty-apprt-gtk/src/winproto/wayland.rs

@@ -524,7 +524,9 @@ impl Window {
             QuickTerminalLayer::Bottom => layer_shell::Layer::Bottom,
             QuickTerminalLayer::Background => layer_shell::Layer::Background,
         });
-        window.set_namespace(Some(config.gtk_quick_terminal_namespace.as_str()));
+        window.set_namespace(Some(
+            ghostty_os::osbytes::config_str_to_text(&config.gtk_quick_terminal_namespace).as_str(),
+        ));
 
         window.set_keyboard_mode(match config.quick_terminal_keyboard_interactivity {
                 QuickTerminalKeyboardInteractivity::None => layer_shell::KeyboardMode::None,