fix: systematic byte fidelity for config strings and RV7 gaps

Resolves the 9 gap groups in docs/rewrite/notes/review-rv7-codex.md and
audits every string-typed config field against its consumers
(field -> consumers -> decode status table in final-Z9.md):
- Windows EnvMap keys use a port of Zig's nls.zig uppercase table
  (upcaseW); Windows locale init follows Zig's chain (setlocale +
  _putenv_s); malformed WTF-8 now fails process launch conversions like
  Zig instead of substituting U+FFFD; kitty file paths convert WTF-8.
- bash --rcfile/--init-file, configured TERM and inherited GTK LANG
  keep their original bytes.
- C API clipboard completion and ghostty_surface_binding_action take
  bytes; complete_clipboard_request is byte-typed through the core.
- text:/csi:/esc: bindings, enquiry-response, input = path:, embedded
  initial_input, search needles, titles, link regexes, clipboard
  codepoint map, command palette text and GTK font/namespace values
  decode the escape encoding before use.

Remaining by design: D-Bus a{ss} values and +new-window arguments are
UTF-8 by D-Bus type. C API key/preedit text follows separately.

Test Plan:
- cargo test --workspace
- just check-macos (both), just check-windows, just check-wasm

crates/ghostty-config/src/io.rs

@@ -2,6 +2,8 @@
 
 use std::fmt;
 
+use ghostty_os::osbytes::EncodedOs;
+
 use crate::{
     cli_args::{ArgError, ConfigField, split_tagged_union},
     formatter::EntryFormatter,
@@ -16,8 +18,11 @@ use crate::{
 /// might be produced in an intermediate state.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum ReadableIO {
+    /// Raw bytes in the reversible OS-byte encoding (decode with
+    /// `osbytes::config_str_to_bytes` after [`ReadableIO::clone_parsed`]).
     Raw(String),
-    Path(String),
+    /// A file path (decode with `EncodedOs::to_path` before opening).
+    Path(EncodedOs),
 }
 
 impl Default for ReadableIO {
@@ -34,7 +39,9 @@ impl ReadableIO {
         // Parsing can't fail because we validate it in parse_cli
         match self {
             ReadableIO::Raw(v) => ReadableIO::Raw(string::parse(v).unwrap_or_default()),
-            ReadableIO::Path(v) => ReadableIO::Path(string::parse(v).unwrap_or_default()),
+            ReadableIO::Path(v) => ReadableIO::Path(EncodedOs::from_encoded(
+                string::parse(v.as_encoded()).unwrap_or_default(),
+            )),
         }
     }
 }
@@ -55,7 +62,7 @@ impl ConfigField for ReadableIO {
         let (tag, rest) = split_tagged_union(input);
         *self = match tag {
             "raw" => ReadableIO::Raw(rest.to_string()),
-            "path" => ReadableIO::Path(rest.to_string()),
+            "path" => ReadableIO::Path(EncodedOs::from_encoded(rest)),
             _ => ReadableIO::Raw(input.to_string()),
         };
         Ok(())
@@ -63,8 +70,8 @@ impl ConfigField for ReadableIO {
 
     fn format_entry(&self, f: &mut EntryFormatter<'_>) -> fmt::Result {
         let (tag, v) = match self {
-            ReadableIO::Raw(v) => ("raw", v),
-            ReadableIO::Path(v) => ("path", v),
+            ReadableIO::Raw(v) => ("raw", v.as_str()),
+            ReadableIO::Path(v) => ("path", v.as_encoded()),
         };
         writeln!(f.writer, "{} = {tag}:{v}", f.name)
     }
@@ -126,7 +133,18 @@ mod tests {
         io.parse_cli(Some("raw:foo")).unwrap();
         assert_eq!(io, ReadableIO::Raw("foo".into()));
         io.parse_cli(Some("path:foo")).unwrap();
-        assert_eq!(io, ReadableIO::Path("foo".into()));
+        assert_eq!(io, ReadableIO::Path(EncodedOs::from_plain_text("foo")));
+    }
+
+    #[test]
+    fn readable_io_path_decodes_to_the_original_bytes() {
+        let mut io = ReadableIO::default();
+        let enc = EncodedOs::from_bytes(b"/tmp/\xffin").into_encoded();
+        io.parse_cli(Some(&format!("path:{enc}"))).unwrap();
+        let ReadableIO::Path(p) = io.clone_parsed() else {
+            panic!("path expected")
+        };
+        assert_eq!(p.to_bytes(), b"/tmp/\xffin");
     }
 
     #[test]

crates/ghostty-config/src/string.rs

@@ -75,8 +75,21 @@ fn parse_escape_sequence(bytes: &[u8], i: &mut usize) -> Option<u32> {
     Some(cp)
 }
 
+/// Parse a string literal into the original bytes (Zig `parse`'s output).
+/// `input` is a config string in the reversible OS-byte encoding; the result
+/// is decoded, so it can be written to the pty / OS directly.
+pub fn parse_bytes(input: &str) -> Result<Vec<u8>, StringError> {
+    parse(input).map(|s| ghostty_os::osbytes::config_str_to_bytes(&s))
+}
+
 /// Parse a string literal into a string. The string can contain
 /// any valid Zig string literal escape sequences.
+///
+/// The input and output are in the reversible OS-byte encoding (see
+/// `ghostty_os::osbytes`): bytes are copied through unchanged, and a
+/// code point produced by an escape is encoded as plain text, so a
+/// literal `U+FDD0` from `\u{fdd0}` stays distinct from the escape
+/// character. Use [`parse_bytes`] for the raw bytes.
 pub fn parse(bytes: &str) -> Result<String, StringError> {
     let b = bytes.as_bytes();
     let mut out = String::with_capacity(bytes.len());
@@ -95,7 +108,12 @@ pub fn parse(bytes: &str) -> Result<String, StringError> {
 
         let cp = parse_escape_sequence(b, &mut i).ok_or(StringError::InvalidString)?;
         // Surrogates cannot be encoded.
-        out.push(char::from_u32(cp).ok_or(StringError::InvalidString)?);
+        let ch = char::from_u32(cp).ok_or(StringError::InvalidString)?;
+        if ch == '\u{FDD0}' {
+            out.push_str("\u{FDD0}\u{FDD0}");
+        } else {
+            out.push(ch);
+        }
     }
     Ok(out)
 }
@@ -138,6 +156,24 @@ impl CodepointIterator<'_> {
 #[cfg(test)]
 #[allow(clippy::unwrap_used)]
 mod tests {
+    #[test]
+    fn parse_bytes_decodes_the_reversible_encoding() {
+        use ghostty_os::osbytes::EncodedOs;
+
+        use super::{parse, parse_bytes};
+
+        // Raw non-UTF-8 bytes pass through as the same bytes.
+        let enc = EncodedOs::from_bytes(b"a\xffb\\n").into_encoded();
+        assert_eq!(parse_bytes(&enc).unwrap(), b"a\xffb\n");
+        // A literal U+FDD0 (typed or via an escape) is that character.
+        let lit = EncodedOs::from_plain_text("\u{fdd0}").into_encoded();
+        assert_eq!(parse_bytes(&lit).unwrap(), "\u{fdd0}".as_bytes());
+        assert_eq!(parse_bytes("\\u{fdd0}").unwrap(), "\u{fdd0}".as_bytes());
+        // An escape producing U+FF is the UTF-8 encoding, not byte FF.
+        assert_eq!(parse_bytes("\\xff").unwrap(), "\u{ff}".as_bytes());
+        assert!(parse("\\u{d800}").is_err());
+    }
+
     use super::*;
 
     #[test]