test: differential fuzzing of the terminal core against Ghostty's Zig code

Adds tools/difftest: a Zig driver built against a copy of Ghostty
1.3.1's own src/terminal (Zig 0.15.2, set up under target/ by
tools/difftest/setup.sh) and a Rust twin on ghostty-terminal, both
printing a canonical dump of every scrollback/active row (cells,
graphemes, styles, hyperlinks, row flags), cursor, modes, regions,
tabstops and colors. A seeded generator produces escape-heavy streams
(UTF-8/wide/combining/emoji, C0, CSI with edge params, SGR, modes, ESC,
OSC, DCS, margins, insert/delete); `just difftest` runs it with Zig
assertions on (ReleaseSafe vs debug Rust) and off (ReleaseFast vs
production Rust), with minimizers and a triage script.

Divergences found and fixed in Rust (each with a regression test):
- ill-formed UTF-8 decoding follows the SIMD path a default Ghostty
  build uses (not Zig's scalar fallback)
- PageList::erase_rows keeps Zig's row-flag behavior on regrow
- grapheme move on wrap with left/right margins uses the original cell

Upstream bugs found and deliberately NOT replicated (per the project
rule): a stale cell pointer after page growth in Terminal.zig:482/539
that drops a grapheme, plus several Zig assertion failures/segfaults;
documented with minimized repros in docs/rewrite/notes/difftest-DF.md.

Final run: 390k cases across many geometries, 0 divergences (Zig-abort
cases, ~0.1-0.5%, are not compared).

Test Plan:
- just difftest 20000 "1 2 3"
- cargo test -p ghostty-terminal (regression tests)

tools/difftest/triage.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Minimise every failing case in a fails-<seed> dir and print a compact report.
+# usage: triage.sh <fails-dir> [max-cases]
+set -u
+D=$1; N=${2:-30}
+BIN="$(dirname "$0")/../../target/debug/difftest_fuzz"
+for f in $(ls "$D"/*.bin | head -n "$N"); do
+  n=$(basename "$f" .bin); IFS=- read -r _ sz sb <<<"$n"
+  echo "== $n"
+  timeout 300 "$BIN" min "${sz%x*}" "${sz#*x}" "${sb#sb}" "$f" | head -8
+done