feat(os): port Ghostty's Linux OS helpers

Ports ZIG/src/os for Linux into ghostty-os: XDG dirs, home dir, hostname,
env/PATH helpers, passwd lookup (via nix), shell detection, resources
dir discovery, string encodings (printf-q, URL percent), systemd
sd_notify, i18n via gettextrs, xdg-open, desktop/cgroup/kernel info,
temp dirs, URI parsing (port of std.Uri incl. Ghostty's extra options),
and a zbus-based Flatpak HostCommand implementation.

The crate stays free of unsafe. Consequences, all tracked as
TODO(integration) in docs/rewrite/notes/ghostty-os.md:
- locale::ensure_locale is a no-op (setlocale/setenv are unsafe; GTK
  calls setlocale itself); setenv/unsetenv are not exposed.
- passwd's Flatpak branch needs the termio pty and falls back to the
  sandbox entry for now.
- FlatpakHostCommand's D-Bus path is untested (no portal here).
Intentional fix: a leading '@' in NOTIFY_SOCKET is treated as an
abstract socket.

macOS/Windows/WASM modules are out of scope.

Test Plan:
- cargo test -p ghostty-os (88 tests)
- cargo clippy -p ghostty-os --all-targets -- -D warnings

crates/ghostty-os/src/pipe.rs

@@ -0,0 +1,28 @@
+use std::io;
+use std::os::fd::OwnedFd;
+
+/// pipe() for POSIX. Sets CLOEXEC on the file descriptors.
+/// Returns `(read, write)`.
+pub fn pipe() -> io::Result<(OwnedFd, OwnedFd)> {
+    rustix::pipe::pipe_with(rustix::pipe::PipeFlags::CLOEXEC).map_err(io::Error::from)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::{Read, Write};
+
+    #[test]
+    fn pipe_roundtrip_cloexec() {
+        let (r, w) = pipe().unwrap();
+        let flags = rustix::io::fcntl_getfd(&r).unwrap();
+        assert!(flags.contains(rustix::io::FdFlags::CLOEXEC));
+        let mut w = std::fs::File::from(w);
+        let mut r = std::fs::File::from(r);
+        w.write_all(b"hi").unwrap();
+        drop(w);
+        let mut s = String::new();
+        r.read_to_string(&mut s).unwrap();
+        assert_eq!(s, "hi");
+    }
+}