feat(macos): port Ghostty's macOS code paths (Metal, CoreText, Darwin)

Ports the macOS-specific Zig code behind cfg(target_os = "macos"):
- renderer: a GraphicsApi trait with generic::Renderer<G>; Metal backend
  (all renderer/metal/* files, shaders.metal verbatim, runtime library
  compile, IOSurface layer, CVDisplayLink), shadertoy -> MSL via naga;
  OpenGL remains the backend elsewhere.
- font: CoreText face, shaper and discovery with build.rs backend
  selection (coretext default; coretext-freetype / coretext-harfbuzz /
  coretext-noshape features), no fontconfig/freetype/harfbuzz on Apple.
- input: KeymapDarwin via UCKeyTranslate, option-as-alt, mac keycodes.
- os: macos, mach, cf_release_thread, NSProcessInfo args and macOS
  branches; config: macOS defaults, keybinds, Application Support paths.
- termio/core: login(1) wrapping, openpty/execvpe, Darwin child exit
  handling, os_log logging.

Compile-checked for aarch64/x86_64-apple-darwin (clippy -D warnings
clean) using the cross setup in docs/rewrite/notes/macos-M1.md; cannot
run here. The embedded runtime/C API (embedded.zig) is the next step.

Also includes the cross-platform integration edits shared by the crash,
verification, Windows and macOS work (Cargo target-gating, thread
crash-context hooks, apprt-gtk surface/IME refactor, termio/os cfg
gates), a cfg fix so ghostty-config builds on wasm32, and an allow for
the intentional recursion in the crash overflow test.

Test Plan:
- cargo test --workspace (3224 passed)
- cargo clippy --workspace --all-targets -- -D warnings
- cargo check --target aarch64-apple-darwin -p ghostty-renderer (with
  the documented cross env)

crates/ghostty-termio/src/mailbox.rs

@@ -152,6 +152,31 @@ mod tests {
         assert!(matches!(back, Message::Focused(true)));
     }
 
+    /// Block until the wakeup is signaled.
+    #[cfg(unix)]
+    fn wait_readable(w: &Wakeup) {
+        let mut fds = [rustix::event::PollFd::from_borrowed_fd(
+            w.as_fd(),
+            rustix::event::PollFlags::IN,
+        )];
+        rustix::event::poll(&mut fds, None).unwrap();
+    }
+
+    /// Block until the wakeup is signaled (this consumes the auto-reset
+    /// event; the callers' `drain` after it is then a harmless no-op).
+    #[cfg(windows)]
+    #[allow(unsafe_code)]
+    fn wait_readable(w: &Wakeup) {
+        use std::os::windows::io::AsRawHandle;
+        // SAFETY: valid event handle owned by the wakeup.
+        unsafe {
+            windows_sys::Win32::System::Threading::WaitForSingleObject(
+                w.as_handle().as_raw_handle().cast(),
+                windows_sys::Win32::System::Threading::INFINITE,
+            )
+        };
+    }
+
     #[test]
     fn blocking_send_wakes_consumer_and_completes() {
         let mb = Mailbox::new().unwrap();
@@ -161,11 +186,7 @@ mod tests {
         let consumer = mb.clone();
         let t = std::thread::spawn(move || {
             // Wait for the wakeup the full-queue path posts, then drain.
-            let mut fds = [rustix::event::PollFd::from_borrowed_fd(
-                consumer.wakeup().as_fd(),
-                rustix::event::PollFlags::IN,
-            )];
-            rustix::event::poll(&mut fds, None).unwrap();
+            wait_readable(consumer.wakeup());
             consumer.wakeup().drain();
             consumer.drain().count()
         });
@@ -185,11 +206,7 @@ mod tests {
         let m2 = Arc::clone(&m);
         // The consumer needs the lock to make progress (like the IO thread).
         let t = std::thread::spawn(move || {
-            let mut fds = [rustix::event::PollFd::from_borrowed_fd(
-                consumer.wakeup().as_fd(),
-                rustix::event::PollFlags::IN,
-            )];
-            rustix::event::poll(&mut fds, None).unwrap();
+            wait_readable(consumer.wakeup());
             let mut g = m2.lock().unwrap();
             *g += 1;
             consumer.drain().count()