refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-os/src/env.rs

@@ -259,13 +259,13 @@ pub fn getenv_not_empty_os(key: &str) -> Option<OsString> {
 /// Gets the value of an environment variable, or None if not found. A
 /// non-UTF-8 value is still present: its invalid bytes are carried through
 /// the reversible [`crate::osbytes`] encoding.
-pub fn getenv(key: &str) -> Option<String> {
-    getenv_os(key).map(|v| crate::osbytes::os_to_config_string(&v))
+pub fn getenv(key: &str) -> Option<crate::osbytes::EncodedOs> {
+    getenv_os(key).map(|v| crate::osbytes::EncodedOs::from_os(&v))
 }
 
 /// Gets the value of an environment variable. Returns None if not found or
 /// the value is empty.
-pub fn getenv_not_empty(key: &str) -> Option<String> {
+pub fn getenv_not_empty(key: &str) -> Option<crate::osbytes::EncodedOs> {
     getenv(key).filter(|v| !v.is_empty())
 }
 
@@ -324,7 +324,10 @@ mod tests {
             assert_eq!(getenv_os("GHOSTTY_RS_T3").unwrap(), v);
             assert_eq!(getenv_not_empty_os("GHOSTTY_RS_T3").unwrap(), v);
             let s = getenv("GHOSTTY_RS_T3").unwrap();
-            assert_eq!(crate::osbytes::config_str_to_bytes(&s), vec![b'a', 0xff]);
+            assert_eq!(
+                crate::osbytes::config_str_to_bytes(s.as_encoded()),
+                vec![b'a', 0xff]
+            );
             assert!(getenv_not_empty("GHOSTTY_RS_T3").is_some());
         });
     }
@@ -361,9 +364,9 @@ mod tests {
         temp_env::with_vars(
             [("GHOSTTY_RS_T1", Some("")), ("GHOSTTY_RS_T2", Some("v"))],
             || {
-                assert_eq!(getenv("GHOSTTY_RS_T1").as_deref(), Some(""));
+                assert_eq!(getenv("GHOSTTY_RS_T1").unwrap(), "");
                 assert_eq!(getenv_not_empty("GHOSTTY_RS_T1"), None);
-                assert_eq!(getenv_not_empty("GHOSTTY_RS_T2").as_deref(), Some("v"));
+                assert_eq!(getenv_not_empty("GHOSTTY_RS_T2").unwrap(), "v");
                 assert_eq!(getenv_not_empty("GHOSTTY_RS_NOPE"), None);
             },
         );