feat(macos): port Ghostty's macOS code paths (Metal, CoreText, Darwin)

Ports the macOS-specific Zig code behind cfg(target_os = "macos"):
- renderer: a GraphicsApi trait with generic::Renderer<G>; Metal backend
  (all renderer/metal/* files, shaders.metal verbatim, runtime library
  compile, IOSurface layer, CVDisplayLink), shadertoy -> MSL via naga;
  OpenGL remains the backend elsewhere.
- font: CoreText face, shaper and discovery with build.rs backend
  selection (coretext default; coretext-freetype / coretext-harfbuzz /
  coretext-noshape features), no fontconfig/freetype/harfbuzz on Apple.
- input: KeymapDarwin via UCKeyTranslate, option-as-alt, mac keycodes.
- os: macos, mach, cf_release_thread, NSProcessInfo args and macOS
  branches; config: macOS defaults, keybinds, Application Support paths.
- termio/core: login(1) wrapping, openpty/execvpe, Darwin child exit
  handling, os_log logging.

Compile-checked for aarch64/x86_64-apple-darwin (clippy -D warnings
clean) using the cross setup in docs/rewrite/notes/macos-M1.md; cannot
run here. The embedded runtime/C API (embedded.zig) is the next step.

Also includes the cross-platform integration edits shared by the crash,
verification, Windows and macOS work (Cargo target-gating, thread
crash-context hooks, apprt-gtk surface/IME refactor, termio/os cfg
gates), a cfg fix so ghostty-config builds on wasm32, and an allow for
the intentional recursion in the crash overflow test.

Test Plan:
- cargo test --workspace (3224 passed)
- cargo clippy --workspace --all-targets -- -D warnings
- cargo check --target aarch64-apple-darwin -p ghostty-renderer (with
  the documented cross env)

crates/ghostty-os/src/pipe.rs

@@ -1,12 +1,53 @@
+#[cfg(unix)]
 use std::{io, os::fd::OwnedFd};
 
 /// pipe() for POSIX. Sets CLOEXEC on the file descriptors.
 /// Returns `(read, write)`.
+#[cfg(all(unix, not(target_vendor = "apple")))]
 pub fn pipe() -> io::Result<(OwnedFd, OwnedFd)> {
     rustix::pipe::pipe_with(rustix::pipe::PipeFlags::CLOEXEC).map_err(io::Error::from)
 }
 
-#[cfg(test)]
+/// pipe() for Darwin, which has no `pipe2`: like Zig's `posix.pipe2`
+/// fallback, create the pipe and then set CLOEXEC on both ends.
+#[cfg(target_vendor = "apple")]
+pub fn pipe() -> io::Result<(OwnedFd, OwnedFd)> {
+    let (r, w) = rustix::pipe::pipe().map_err(io::Error::from)?;
+    for fd in [&r, &w] {
+        rustix::io::fcntl_setfd(fd, rustix::io::FdFlags::CLOEXEC).map_err(io::Error::from)?;
+    }
+    Ok((r, w))
+}
+
+/// pipe() for Windows (`CreatePipe` with default security attributes, so the
+/// handles are not inheritable). Returns `(read, write)`.
+#[cfg(windows)]
+#[allow(unsafe_code)]
+pub fn pipe() -> std::io::Result<(
+    std::os::windows::io::OwnedHandle,
+    std::os::windows::io::OwnedHandle,
+)> {
+    use std::os::windows::io::{FromRawHandle, OwnedHandle};
+
+    use windows_sys::Win32::{Foundation::HANDLE, System::Pipes::CreatePipe};
+
+    let mut read: HANDLE = std::ptr::null_mut();
+    let mut write: HANDLE = std::ptr::null_mut();
+    // SAFETY: both out pointers are valid for writes; null security
+    // attributes and size 0 request the defaults.
+    if unsafe { CreatePipe(&raw mut read, &raw mut write, std::ptr::null(), 0) } == 0 {
+        return Err(std::io::Error::last_os_error());
+    }
+    // SAFETY: CreatePipe succeeded so both handles are valid and owned by us.
+    Ok(unsafe {
+        (
+            OwnedHandle::from_raw_handle(read.cast()),
+            OwnedHandle::from_raw_handle(write.cast()),
+        )
+    })
+}
+
+#[cfg(all(test, unix))]
 mod tests {
     use std::io::{Read, Write};
 
@@ -26,3 +67,22 @@ mod tests {
         assert_eq!(s, "hi");
     }
 }
+
+#[cfg(all(test, windows))]
+mod tests_windows {
+    use std::io::{Read, Write};
+
+    use super::*;
+
+    #[test]
+    fn pipe_roundtrip() {
+        let (r, w) = pipe().unwrap();
+        let mut w = std::fs::File::from(w);
+        let mut r = std::fs::File::from(r);
+        w.write_all(b"hi").unwrap();
+        drop(w);
+        let mut s = String::new();
+        r.read_to_string(&mut s).unwrap();
+        assert_eq!(s, "hi");
+    }
+}