refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-lib/src/embedded.rs

@@ -619,7 +619,7 @@ impl RtSurface for SurfaceRt {
         true
     }
 
-    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, String)], confirm: bool) {
+    fn set_clipboard(&self, clipboard: Clipboard, contents: &[(String, Vec<u8>)], confirm: bool) {
         let Some(cb) = self.app.opts.write_clipboard_cb else {
             return;
         };
@@ -628,7 +628,8 @@ impl RtSurface for SurfaceRt {
             .map(|(m, d)| {
                 (
                     CString::new(m.replace('\0', "")).unwrap_or_default(),
-                    CString::new(d.replace('\0', "")).unwrap_or_default(),
+                    CString::new(d.iter().copied().filter(|b| *b != 0).collect::<Vec<u8>>())
+                        .unwrap_or_default(),
                 )
             })
             .collect();
@@ -889,7 +890,7 @@ unsafe fn apply_surface_options(config: &mut Config, opts: &ghostty_surface_conf
         && !wd.is_empty()
     {
         // Raw bytes are kept (reversible escape in the String based config).
-        let wd_str = osbytes::bytes_to_config_string(wd);
+        let wd_str = osbytes::EncodedOs::from_bytes(wd);
         let wd_os = osbytes::os_from_bytes(wd.to_vec());
         let wd_disp = String::from_utf8_lossy(wd);
         match std::fs::metadata(&wd_os) {
@@ -2207,7 +2208,7 @@ mod tests {
             .as_ref()
             .and_then(|w| w.value())
             .unwrap();
-        assert_eq!(osbytes::config_str_to_bytes(got_wd), dir);
+        assert_eq!(got_wd.to_bytes(), dir);
         let Some(Command::Shell(c)) = &config.command else {
             panic!("no command");
         };