fix: close remaining gaps found by the completeness audit

Addresses the partial ports listed in
docs/rewrite/notes/review-completeness-codex.md (details in
docs/rewrite/notes/gaps-X2.md):
- Flatpak: the exit watcher no longer consumes the host command; a
  shared FlatpakSignalHandle lets closing a surface still SIGHUP the
  host process group.
- Child environment is byte-preserving end to end (ghostty_os::EnvMap
  of OsStrings) and Snap paths are filtered like filterSnapPaths.
- argv handling no longer panics on non-UTF-8 arguments.
- URI percent-decoding keeps raw bytes; OSC 7 pwd is passed through
  without lossy conversion.
- Keybinding comparison/hashing uses full Unicode case folding from a
  table generated from CaseFolding.txt (Unicode 17.0.0).
- Link regexes set Oniguruma's whole-search retry limit through the new
  minimal ghostty-onig crate (one SAFETY-commented FFI call).
- OSC 9 NUL-capacity check ordering matches Zig.
- Wayland registry binds/clears globals advertised after startup.
- Custom shaders may pass sampler2D to helper functions (naga adapter).
- +list-themes preview renders OSC 8 links, styled underlines and
  follows color-scheme reports.

Also includes the inspector's integration edits in shared files
(renderer state hook, termio VT recording, core/apprt-gtk wiring), X1's
config/input/cli additions for completion generation, and a fix for a
race in the termio backpressure test (it wrote before `stty raw`
applied, so the cooked line discipline dropped bytes past MAX_CANON).

Test Plan:
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings

crates/ghostty-terminal/Cargo.toml

@@ -13,6 +13,7 @@ ghostty-unicode.workspace = true
 ghostty-vt.workspace = true
 log = "0.4.34"
 onig = "6.5.3"
+ghostty-onig.workspace = true
 png = "0.18.1"
 rustix = { version = "1.1.5", features = ["shm", "fs"] }
 thiserror = "2.0.21"

crates/ghostty-terminal/src/page.rs

@@ -977,6 +977,21 @@ impl Page {
     pub fn lookup_hyperlink(&self, index: usize) -> Option<u16> {
         self.hyperlink_map.get(&index).copied()
     }
+    /// Bytes of string storage currently in use (Zig:
+    /// `string_alloc.usedBytes`); used by the inspector.
+    pub fn string_used_bytes(&self) -> usize {
+        let used: usize = self
+            .string_alloc
+            .used
+            .iter()
+            .map(|w| w.count_ones() as usize)
+            .sum();
+        used * self.string_alloc.chunk
+    }
+    /// Total bytes of string storage (Zig: `string_alloc.capacityBytes`).
+    pub fn string_capacity_bytes(&self) -> usize {
+        self.string_alloc.chunks * self.string_alloc.chunk
+    }
     /// Number of hyperlink cells.
     pub fn hyperlink_count(&self) -> usize {
         self.hyperlink_map.len()

crates/ghostty-terminal/src/page_list.rs

@@ -863,6 +863,11 @@ impl PageList {
         let i = page.cell_index(usize::from(p.x), usize::from(p.y)).ok()?;
         page.cells.get_mut(i)
     }
+    /// The handle of the internal tracked viewport pin, if any (used by the
+    /// inspector to label it).
+    pub fn viewport_pin_handle(&self) -> Option<TrackedPin> {
+        self.viewport_pin
+    }
     /// Number of live pages in list order.
     pub fn total_pages(&self) -> usize {
         self.nodes.iter().filter(|n| n.is_some()).count()

crates/ghostty-terminal/src/string_map.rs

@@ -11,9 +11,10 @@ use onig::{MatchParam, Regex, Region, SearchOptions};
 /// Units are Oniguruma retry steps (internal backtracking/retry counter),
 /// not bytes/characters/time.
 ///
-/// Deviation: the `onig` crate only exposes the retry limit *in match*
-/// (Zig also sets the retry limit in search); both abort matching with an
-/// error which is treated as "no further matches".
+/// This is Zig's `setRetryLimitInSearch`: a whole-search budget (set via
+/// the `ghostty-onig` wrapper since the `onig` crate does not expose it).
+/// Exceeding it aborts matching with an error which is treated as "no
+/// further matches".
 const ONI_SEARCH_RETRY_LIMIT: u32 = 100_000;
 
 /// A string and a map from each byte of the string to the pin it came from.
@@ -52,7 +53,7 @@ impl<'a> SearchIterator<'a> {
         // Use per-search match params so we can bound regex retry steps
         // (Oniguruma's internal backtracking work counter).
         let mut match_param = MatchParam::default();
-        match_param.set_retry_limit_in_match(ONI_SEARCH_RETRY_LIMIT);
+        ghostty_onig::set_retry_limit_in_search(&mut match_param, ONI_SEARCH_RETRY_LIMIT);
 
         let haystack = &self.map.string[self.offset..];
         let mut region = Region::new();
@@ -195,6 +196,19 @@ mod tests {
         assert!(it.next_match().is_none());
     }
 
+    #[test]
+    fn string_map_search_iterator_retry_limit_bounds_catastrophic_regex() {
+        // Exponential backtracking: without the whole-search retry limit
+        // this would effectively never finish.
+        let re = Regex::new("(a+)+$").unwrap();
+        let mut s = Screen::new(Options::new(60, 5, 0)).unwrap();
+        s.test_write_string(&format!("{}b", "a".repeat(50)))
+            .unwrap();
+        let map = line_map(&s, 10, 0);
+        let mut it = map.search_iterator(&re);
+        assert!(it.next_match().is_none());
+    }
+
     #[test]
     fn string_map_search_iterator_url_with_click_position() {
         let re = Regex::new(ghostty_config::url::REGEX).unwrap();