refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-apprt/Cargo.toml

@@ -11,6 +11,7 @@ ghostty-config.workspace = true
 ghostty-datastruct.workspace = true
 ghostty-inspector.workspace = true
 ghostty-terminal.workspace = true
+ghostty-os.workspace = true
 ghostty-renderer.workspace = true
 thiserror = "2.0.21"
 

crates/ghostty-apprt/src/action.rs

@@ -650,16 +650,14 @@ impl std::fmt::Display for SetTitle {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Pwd {
     /// The working directory as reported by OSC 7. Zig keeps raw bytes; here
-    /// non-UTF-8 bytes are carried with the reversible escape of
-    /// `ghostty_os::osbytes` (valid UTF-8 is unchanged). Decode with
-    /// `osbytes::config_str_to_bytes` / `config_str_to_os` before using it
-    /// as a path or handing it to C.
-    pub pwd: String,
+    /// they are carried as an [`EncodedOs`](ghostty_os::osbytes::EncodedOs)
+    /// that must be decoded (`to_path`/`to_bytes`) at the OS/C boundary.
+    pub pwd: ghostty_os::osbytes::EncodedOs,
 }
 
 impl std::fmt::Display for Pwd {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "Pwd{{ {} }}", self.pwd)
+        write!(f, "Pwd{{ {} }}", self.pwd.as_encoded())
     }
 }
 
@@ -752,8 +750,10 @@ pub struct OpenUrl {
     /// The type of data that the URL refers to.
     pub kind: OpenUrlKind,
 
-    /// The URL.
-    pub url: String,
+    /// The URL or path to open, as raw bytes (Zig `[]const u8`). Plain text
+    /// URLs are wrapped with `EncodedOs::from_plain_text`, file names with
+    /// `EncodedOs::from_path`/`from_bytes`; the opener decodes it.
+    pub url: ghostty_os::osbytes::EncodedOs,
 }
 
 /// The type of the data at the URL to open. This is used as a hint to
@@ -870,7 +870,13 @@ mod tests {
     #[test]
     fn display_formats() {
         assert_eq!(SetTitle { title: "x".into() }.to_string(), "SetTitle{ x }");
-        assert_eq!(Pwd { pwd: "/a".into() }.to_string(), "Pwd{ /a }");
+        assert_eq!(
+            Pwd {
+                pwd: ghostty_os::osbytes::EncodedOs::from_encoded("/a")
+            }
+            .to_string(),
+            "Pwd{ /a }"
+        );
         assert_eq!(
             DesktopNotification {
                 title: "t".into(),

crates/ghostty-apprt/src/runtime_api.rs

@@ -307,7 +307,9 @@ pub trait RtSurface {
     /// `CoreSurface::complete_clipboard_request`. Returns true if started.
     fn clipboard_request(&self, clipboard: Clipboard, state: ClipboardRequest) -> bool;
     /// `setClipboard(type, contents, confirm)`; contents are (mime, data).
-    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, String)], confirm: bool);
+    /// The data is raw bytes like Zig's `[:0]const u8` (a copied file name
+    /// need not be valid UTF-8).
+    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, Vec<u8>)], confirm: bool);
     /// `defaultTermioEnv`: env vars to set for the child (GDK/GTK related
     /// cleanups).
     fn default_termio_env(&self) -> Vec<(std::ffi::OsString, std::ffi::OsString)>;

crates/ghostty-apprt/src/surface.rs

@@ -222,7 +222,11 @@ pub fn should_inherit_working_directory(context: NewSurfaceContext, config: &Con
 /// `app.focusedSurface()?.pwd()`), which the caller (core) must look up.
 // TODO(integration): core could wrap this to resolve the focused surface.
 #[must_use]
-pub fn new_config(config: &Config, context: NewSurfaceContext, prev_pwd: Option<String>) -> Config {
+pub fn new_config(
+    config: &Config,
+    context: NewSurfaceContext,
+    prev_pwd: Option<ghostty_os::osbytes::EncodedOs>,
+) -> Config {
     let mut copy = config.clone();
     if let Some(pwd) = prev_pwd
         && should_inherit_working_directory(context, config)
@@ -238,6 +242,10 @@ mod tests {
 
     use super::*;
 
+    fn tmp() -> ghostty_os::osbytes::EncodedOs {
+        ghostty_os::osbytes::EncodedOs::from_encoded("/tmp")
+    }
+
     struct Rec(RefCell<Vec<(u32, bool)>>);
     impl AppMailbox<u32> for Rec {
         fn push_surface_message(&self, s: u32, m: Message, _t: Timeout) -> usize {
@@ -277,12 +285,9 @@ mod tests {
             NewSurfaceContext::Tab,
             &c
         ));
-        let n = new_config(&c, NewSurfaceContext::Window, Some("/tmp".into()));
-        assert_eq!(
-            n.working_directory,
-            Some(WorkingDirectory::Path("/tmp".into()))
-        );
-        let n = new_config(&c, NewSurfaceContext::Tab, Some("/tmp".into()));
+        let n = new_config(&c, NewSurfaceContext::Window, Some(tmp()));
+        assert_eq!(n.working_directory, Some(WorkingDirectory::Path(tmp())));
+        let n = new_config(&c, NewSurfaceContext::Tab, Some(tmp()));
         assert_eq!(n.working_directory, None);
     }
 }