feat(os): port Ghostty's Linux OS helpers

Ports ZIG/src/os for Linux into ghostty-os: XDG dirs, home dir, hostname,
env/PATH helpers, passwd lookup (via nix), shell detection, resources
dir discovery, string encodings (printf-q, URL percent), systemd
sd_notify, i18n via gettextrs, xdg-open, desktop/cgroup/kernel info,
temp dirs, URI parsing (port of std.Uri incl. Ghostty's extra options),
and a zbus-based Flatpak HostCommand implementation.

The crate stays free of unsafe. Consequences, all tracked as
TODO(integration) in docs/rewrite/notes/ghostty-os.md:
- locale::ensure_locale is a no-op (setlocale/setenv are unsafe; GTK
  calls setlocale itself); setenv/unsetenv are not exposed.
- passwd's Flatpak branch needs the termio pty and falls back to the
  sandbox entry for now.
- FlatpakHostCommand's D-Bus path is untested (no portal here).
Intentional fix: a leading '@' in NOTIFY_SOCKET is treated as an
abstract socket.

macOS/Windows/WASM modules are out of scope.

Test Plan:
- cargo test -p ghostty-os (88 tests)
- cargo clippy -p ghostty-os --all-targets -- -D warnings

crates/ghostty-os/src/testutil.rs

@@ -0,0 +1,9 @@
+//! Test helpers. Process environment mutation is `unsafe` in Rust 2024, so
+//! tests go through `temp_env`, which serializes env access with a global
+//! lock. Tests that merely *read* env vars that other tests mutate should
+//! take the same lock via [`with_env_lock`].
+
+/// Run `f` while holding the global env lock (no variables changed).
+pub fn with_env_lock<R>(f: impl FnOnce() -> R) -> R {
+    temp_env::with_vars(Vec::<(&str, Option<&str>)>::new(), f)
+}