test(core): add headless end-to-end tests and fix bugs they found

Adds crates/ghostty-core/tests/e2e_*.rs: 81 tests that drive the real
core Surface, termio, pty and child processes through a fake runtime
(recording apprt actions, in-memory clipboard) with a headless renderer
(ghostty-renderer/src/headless.rs). They cover keys (legacy, DECCKM,
kitty, modifyOtherKeys), keybinding actions and sequences, mouse
selection/reporting/scrolling/links, clipboard incl. OSC 52 and paste
safety, resize, focus, titles/pwd/bell/notifications/progress, child
exit, and IME preedit.

Fixes for issues found by the tests and by the Codex audit
(docs/rewrite/notes/review-core-codex.md, all 9 items):
- replacing a selection with copy-on-select panicked (stale tracked
  handles); global new_window no longer inherits a parent; the child
  environment uses the runtime's env wholesale so GTK's removals stick;
  Flatpak host resources path; locale recovery (ensureLocale) in
  apprt-gtk before GTK init and for CLI actions; failed screen-file
  opens propagate errors; OSC 52 base64 rules, CSI/ESC binding length
  limits and GHOSTTY_LOG parsing match Zig.
- Also includes V2's termio cleanups (tmux viewer wiring in the stream
  handler, Pty slave semantics docs, shared cgroup wait loop).

apprt-gtk gains a debug input replay hook (GHOSTTY_DEBUG_INPUT_SCRIPT)
exercising the real GTK key path. With it, the real app was verified on
Wayland: typing and output, new tab, splits, select-all/copy/paste and
font size all work (docs/rewrite/notes/verification-V1.md). Not yet
exercised at GTK level: mouse, real IM-context IME, clipboard dialogs.

Test Plan:
- cargo test --workspace (2983 passed)
- cargo test -p ghostty-core --tests (81 e2e tests)

crates/ghostty-renderer/src/headless.rs

@@ -0,0 +1,115 @@
+//! Headless GL context (surfaceless EGL, Mesa) for tests and tools that need a
+//! current OpenGL 4.3 core context without a window system.
+//!
+//! This is a test-support API (not used by the application): integration tests
+//! of other crates (e.g. `ghostty-core/tests/e2e_*.rs`) use it to build a real
+//! [`Renderer`](crate::Renderer) without GTK. The context is made current on
+//! the thread that calls [`Headless::new`] and must be dropped on that thread.
+
+#![allow(unsafe_code)]
+
+use std::ffi::c_void;
+
+use khronos_egl as egl;
+
+// EGL_PLATFORM_SURFACELESS_MESA, falling back to the default display.
+const PLATFORM_SURFACELESS_MESA: egl::Enum = 0x31DD;
+
+/// A surfaceless EGL context, current on the creating thread.
+pub struct Headless {
+    egl: egl::DynamicInstance<egl::EGL1_5>,
+    display: egl::Display,
+    context: egl::Context,
+}
+
+impl Headless {
+    /// Create a GL 4.3 core context and make it current on this thread.
+    pub fn new() -> Result<Headless, String> {
+        // SAFETY: loads the system libEGL.
+        let egl = unsafe { egl::DynamicInstance::<egl::EGL1_5>::load_required() }
+            .map_err(|e| format!("cannot load libEGL: {e}"))?;
+
+        // SAFETY: EGL_DEFAULT_DISPLAY with an empty (terminated) attribute list.
+        let display = unsafe {
+            egl.get_platform_display(
+                PLATFORM_SURFACELESS_MESA,
+                egl::DEFAULT_DISPLAY,
+                &[egl::ATTRIB_NONE],
+            )
+        }
+        .or_else(|_| {
+            // SAFETY: default display handle.
+            unsafe { egl.get_display(egl::DEFAULT_DISPLAY) }.ok_or(egl::Error::BadDisplay)
+        })
+        .map_err(|e| format!("no EGL display: {e}"))?;
+        egl.initialize(display)
+            .map_err(|e| format!("eglInitialize: {e}"))?;
+        egl.bind_api(egl::OPENGL_API)
+            .map_err(|e| format!("eglBindAPI: {e}"))?;
+
+        let attribs = [
+            egl::RENDERABLE_TYPE,
+            egl::OPENGL_BIT,
+            egl::SURFACE_TYPE,
+            egl::PBUFFER_BIT,
+            egl::NONE,
+        ];
+        let config = egl
+            .choose_first_config(display, &attribs)
+            .map_err(|e| format!("eglChooseConfig: {e}"))?
+            .ok_or("no EGL config")?;
+        let ctx_attribs = [
+            egl::CONTEXT_MAJOR_VERSION,
+            4,
+            egl::CONTEXT_MINOR_VERSION,
+            3,
+            egl::CONTEXT_OPENGL_PROFILE_MASK,
+            egl::CONTEXT_OPENGL_CORE_PROFILE_BIT,
+            egl::NONE,
+        ];
+        let context = egl
+            .create_context(display, config, None, &ctx_attribs)
+            .map_err(|e| format!("eglCreateContext (GL 4.3 core): {e}"))?;
+        // Surfaceless: EGL_KHR_surfaceless_context.
+        egl.make_current(display, None, None, Some(context))
+            .map_err(|e| format!("eglMakeCurrent: {e}"))?;
+        Ok(Headless {
+            egl,
+            display,
+            context,
+        })
+    }
+
+    /// `glViewport(0, 0, width, height)`. The renderer reads the viewport to
+    /// learn the surface size (GTK's `GLArea` sets it before every render), so
+    /// headless callers must set it to the surface size.
+    pub fn set_viewport(&self, width: i32, height: i32) {
+        let p = self.proc_address("glViewport");
+        if p.is_null() {
+            return;
+        }
+        // SAFETY: `glViewport` has the C signature `void(GLint, GLint, GLsizei,
+        // GLsizei)`; the context is current on this thread.
+        unsafe {
+            let f: extern "C" fn(i32, i32, i32, i32) = std::mem::transmute(p);
+            f(0, 0, width, height);
+        }
+    }
+
+    /// Resolve a GL function pointer (null if unknown).
+    #[must_use]
+    pub fn proc_address(&self, name: &str) -> *const c_void {
+        self.egl
+            .get_proc_address(name)
+            .map_or(std::ptr::null(), |f| f as *const c_void)
+    }
+}
+
+impl Drop for Headless {
+    fn drop(&mut self) {
+        let _ = self.egl.make_current(self.display, None, None, None);
+        let _ = self.egl.destroy_context(self.display, self.context);
+        // The display is shared by every context of the process (tests run in
+        // parallel threads), so it is deliberately not terminated.
+    }
+}

crates/ghostty-renderer/src/lib.rs

@@ -15,6 +15,7 @@ pub mod backend;
 pub mod cell;
 pub mod cursor;
 pub mod generic;
+pub mod headless;
 pub mod image;
 pub mod link;
 pub mod math;