refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-crash/src/dir.rs

@@ -19,7 +19,8 @@ pub fn default_dir() -> io::Result<Dir> {
     })
     .map_err(|e| io::Error::other(e.to_string()))?;
     Ok(Dir {
-        path: PathBuf::from(path),
+        // The XDG helpers return the encoded form of the OS string.
+        path: path.to_path(),
     })
 }
 
@@ -62,7 +63,7 @@ impl ReportIterator {
             if !entry.file_type()?.is_file() {
                 continue;
             }
-            let name = entry.file_name().to_string_lossy().into_owned();
+            let name = entry.file_name();
             // statFile follows symlinks; entries here are regular files.
             let mtime = fs::metadata(self.dir.join(entry.file_name()))?.modified()?;
             let mtime = match mtime.duration_since(UNIX_EPOCH) {
@@ -84,7 +85,8 @@ impl Iterator for ReportIterator {
 /// A crash report file.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Report {
-    pub name: String,
+    /// The file name as the raw OS string (Zig `[]const u8`).
+    pub name: std::ffi::OsString,
     /// Modification time in nanoseconds since the unix epoch.
     pub mtime: i128,
 }
@@ -121,6 +123,29 @@ mod tests {
         assert_eq!("a.ghosttycrash", r[0].name);
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn default_dir_decodes_non_utf8_xdg_state() {
+        use std::os::unix::ffi::{OsStrExt, OsStringExt};
+        let v = std::ffi::OsString::from_vec(b"/tmp/state\xff".to_vec());
+        let d = temp_env::with_var("XDG_STATE_HOME", Some(&v), || default_dir().unwrap());
+        assert_eq!(
+            d.path.as_os_str().as_bytes(),
+            b"/tmp/state\xff/ghostty/crash"
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn non_utf8_report_name_is_kept() {
+        use std::os::unix::ffi::OsStrExt;
+        let t = tempfile::tempdir().unwrap();
+        let name = std::ffi::OsStr::from_bytes(b"a\xff.ghosttycrash");
+        fs::write(t.path().join(name), "x").unwrap();
+        let r = list_reports(t.path()).unwrap();
+        assert_eq!(r[0].name, name);
+    }
+
     #[test]
     fn default_dir_uses_xdg_state() {
         let d = default_dir().unwrap();