fix: close remaining gaps found by the completeness audit

Addresses the partial ports listed in
docs/rewrite/notes/review-completeness-codex.md (details in
docs/rewrite/notes/gaps-X2.md):
- Flatpak: the exit watcher no longer consumes the host command; a
  shared FlatpakSignalHandle lets closing a surface still SIGHUP the
  host process group.
- Child environment is byte-preserving end to end (ghostty_os::EnvMap
  of OsStrings) and Snap paths are filtered like filterSnapPaths.
- argv handling no longer panics on non-UTF-8 arguments.
- URI percent-decoding keeps raw bytes; OSC 7 pwd is passed through
  without lossy conversion.
- Keybinding comparison/hashing uses full Unicode case folding from a
  table generated from CaseFolding.txt (Unicode 17.0.0).
- Link regexes set Oniguruma's whole-search retry limit through the new
  minimal ghostty-onig crate (one SAFETY-commented FFI call).
- OSC 9 NUL-capacity check ordering matches Zig.
- Wayland registry binds/clears globals advertised after startup.
- Custom shaders may pass sampler2D to helper functions (naga adapter).
- +list-themes preview renders OSC 8 links, styled underlines and
  follows color-scheme reports.

Also includes the inspector's integration edits in shared files
(renderer state hook, termio VT recording, core/apprt-gtk wiring), X1's
config/input/cli additions for completion generation, and a fix for a
race in the termio backpressure test (it wrote before `stty raw`
applied, so the cooked line discipline dropped bytes past MAX_CANON).

Test Plan:
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings

crates/ghostty-terminal/src/string_map.rs

@@ -11,9 +11,10 @@ use onig::{MatchParam, Regex, Region, SearchOptions};
 /// Units are Oniguruma retry steps (internal backtracking/retry counter),
 /// not bytes/characters/time.
 ///
-/// Deviation: the `onig` crate only exposes the retry limit *in match*
-/// (Zig also sets the retry limit in search); both abort matching with an
-/// error which is treated as "no further matches".
+/// This is Zig's `setRetryLimitInSearch`: a whole-search budget (set via
+/// the `ghostty-onig` wrapper since the `onig` crate does not expose it).
+/// Exceeding it aborts matching with an error which is treated as "no
+/// further matches".
 const ONI_SEARCH_RETRY_LIMIT: u32 = 100_000;
 
 /// A string and a map from each byte of the string to the pin it came from.
@@ -52,7 +53,7 @@ impl<'a> SearchIterator<'a> {
         // Use per-search match params so we can bound regex retry steps
         // (Oniguruma's internal backtracking work counter).
         let mut match_param = MatchParam::default();
-        match_param.set_retry_limit_in_match(ONI_SEARCH_RETRY_LIMIT);
+        ghostty_onig::set_retry_limit_in_search(&mut match_param, ONI_SEARCH_RETRY_LIMIT);
 
         let haystack = &self.map.string[self.offset..];
         let mut region = Region::new();
@@ -195,6 +196,19 @@ mod tests {
         assert!(it.next_match().is_none());
     }
 
+    #[test]
+    fn string_map_search_iterator_retry_limit_bounds_catastrophic_regex() {
+        // Exponential backtracking: without the whole-search retry limit
+        // this would effectively never finish.
+        let re = Regex::new("(a+)+$").unwrap();
+        let mut s = Screen::new(Options::new(60, 5, 0)).unwrap();
+        s.test_write_string(&format!("{}b", "a".repeat(50)))
+            .unwrap();
+        let map = line_map(&s, 10, 0);
+        let mut it = map.search_iterator(&re);
+        assert!(it.next_match().is_none());
+    }
+
     #[test]
     fn string_map_search_iterator_url_with_click_position() {
         let re = Regex::new(ghostty_config::url::REGEX).unwrap();