feat(macos): port Ghostty's macOS code paths (Metal, CoreText, Darwin)

Ports the macOS-specific Zig code behind cfg(target_os = "macos"):
- renderer: a GraphicsApi trait with generic::Renderer<G>; Metal backend
  (all renderer/metal/* files, shaders.metal verbatim, runtime library
  compile, IOSurface layer, CVDisplayLink), shadertoy -> MSL via naga;
  OpenGL remains the backend elsewhere.
- font: CoreText face, shaper and discovery with build.rs backend
  selection (coretext default; coretext-freetype / coretext-harfbuzz /
  coretext-noshape features), no fontconfig/freetype/harfbuzz on Apple.
- input: KeymapDarwin via UCKeyTranslate, option-as-alt, mac keycodes.
- os: macos, mach, cf_release_thread, NSProcessInfo args and macOS
  branches; config: macOS defaults, keybinds, Application Support paths.
- termio/core: login(1) wrapping, openpty/execvpe, Darwin child exit
  handling, os_log logging.

Compile-checked for aarch64/x86_64-apple-darwin (clippy -D warnings
clean) using the cross setup in docs/rewrite/notes/macos-M1.md; cannot
run here. The embedded runtime/C API (embedded.zig) is the next step.

Also includes the cross-platform integration edits shared by the crash,
verification, Windows and macOS work (Cargo target-gating, thread
crash-context hooks, apprt-gtk surface/IME refactor, termio/os cfg
gates), a cfg fix so ghostty-config builds on wasm32, and an allow for
the intentional recursion in the crash overflow test.

Test Plan:
- cargo test --workspace (3224 passed)
- cargo clippy --workspace --all-targets -- -D warnings
- cargo check --target aarch64-apple-darwin -p ghostty-renderer (with
  the documented cross env)

crates/ghostty-terminal/src/kitty/graphics_image.rs

@@ -174,7 +174,16 @@ impl LoadingImage {
     }
 
     /// Reads the data from a shared memory segment.
-    #[cfg(not(target_arch = "wasm32"))]
+    ///
+    /// Windows is currently unsupported (as in Zig).
+    #[cfg(windows)]
+    #[allow(clippy::unused_self)]
+    fn read_shared_memory(&mut self, _offset: u32, _size: u32, _path: &[u8]) -> Result<(), Error> {
+        Err(Error::UnsupportedMedium)
+    }
+
+    /// Reads the data from a shared memory segment.
+    #[cfg(not(any(target_arch = "wasm32", windows)))]
     fn read_shared_memory(&mut self, offset: u32, size: u32, path: &[u8]) -> Result<(), Error> {
         use rustix::{fs::Mode, shm};
 
@@ -192,7 +201,7 @@ impl LoadingImage {
         result
     }
 
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(any(target_arch = "wasm32", windows)))]
     fn read_shm_fd(
         &mut self,
         fd: rustix::fd::OwnedFd,
@@ -521,8 +530,7 @@ fn is_path_in_temp_dir(path: &[u8]) -> bool {
     if path.starts_with(b"/dev/shm") {
         return true;
     }
-    {
-        let dir = alloc_tmp_dir();
+    if let Some(dir) = alloc_tmp_dir() {
         if path.starts_with(dir.as_bytes()) {
             return true;
         }
@@ -539,13 +547,21 @@ fn is_path_in_temp_dir(path: &[u8]) -> bool {
 }
 
 /// `os/file.zig allocTmpDir` on POSIX (TMPDIR, TMP, then /tmp).
-fn alloc_tmp_dir() -> String {
+#[cfg(not(windows))]
+#[allow(clippy::unnecessary_wraps)]
+fn alloc_tmp_dir() -> Option<String> {
     for key in ["TMPDIR", "TMP"] {
         if let Some(v) = std::env::var_os(key) {
-            return v.to_string_lossy().into_owned();
+            return Some(v.to_string_lossy().into_owned());
         }
     }
-    "/tmp".to_owned()
+    Some("/tmp".to_owned())
+}
+
+/// `os/file.zig allocTmpDir` on Windows (`TMP` only).
+#[cfg(windows)]
+fn alloc_tmp_dir() -> Option<String> {
+    std::env::var_os("TMP").map(|v| v.to_string_lossy().into_owned())
 }
 
 /// Image represents a single fully loaded image.
@@ -931,7 +947,7 @@ mod tests {
         assert!(loading.complete().is_ok());
     }
 
-    #[cfg(not(target_arch = "wasm32"))]
+    #[cfg(not(any(target_arch = "wasm32", windows)))]
     #[test]
     fn image_load_shared_memory() {
         use std::io::Write;