refactor: type escaped OS strings and fix the final audit findings

Escaped config strings (ghostty_os::osbytes) kept reaching OS
boundaries undecoded, and decoding was occasionally applied to plain
text. The root cause was that both were plain `String`s. Now:
- `EncodedOs` is a newtype (no Display/AsRef<Path>) that decodes only
  via to_os/to_path/to_bytes/to_wide; plain text enters via
  from_plain_text. OS helpers (env, home, xdg, passwd, resources dir,
  path expansion), config::Path, WorkingDirectory, theme/file_load/edit
  paths, terminal pwd, OpenUrl/Pwd actions and termio cwd use it, so the
  compiler forces decoding at every boundary. os::open takes &OsStr.
  Config output is unchanged.

Fixes all rows of docs/rewrite/notes/review-rv5-codex.md (final-Z7.md):
screen-file copy; regex/OSC 8 URLs no longer decoded (regression);
lossless Windows WTF-8/WTF-16 for args, env and CreateProcessW; Windows
resources dir/TERMINFO; color OSC request lists and X11 color lookup no
longer allocate globally (C zero-allocation test extended); macOS Mach
handler resumes all threads before KERN_FAILURE (hang regression) and
SIGABRT minidumps go through the exception thread; plus open-config,
background images, crash dir, ssh cache, exe dir/PATH, fontconfig
filenames, file links, kitty TMPDIR, .hushlogin and benchmark paths.
The typing also surfaced and fixed gtk-custom-css, bell audio, bash
HISTFILE, OSC 52 writes and the C config getters.

Test Plan:
- cargo test --workspace (3376 passed)
- just check-macos (both), just check-windows, just check-wasm
- diff <(ghostty-rs +show-config --default --docs) \
  <(ghostty +show-config --default --docs)

crates/ghostty-terminal/src/kitty/graphics_image.rs

@@ -560,14 +560,20 @@ fn contains_subslice(hay: &[u8], needle: &[u8]) -> bool {
 /// Returns true if path appears to be in a temporary directory.
 /// Copies logic from Kitty.
 fn is_path_in_temp_dir(path: &[u8]) -> bool {
+    is_path_in_temp_dir_with(path, alloc_tmp_dir())
+}
+
+/// [`is_path_in_temp_dir`] with an explicit temporary directory (an OS
+/// string: it may be non-UTF-8, so it is compared byte for byte).
+fn is_path_in_temp_dir_with(path: &[u8], tmp_dir: Option<std::ffi::OsString>) -> bool {
     if path.starts_with(b"/tmp") {
         return true;
     }
     if path.starts_with(b"/dev/shm") {
         return true;
     }
-    if let Some(dir) = alloc_tmp_dir() {
-        if path.starts_with(dir.as_bytes()) {
+    if let Some(dir) = tmp_dir {
+        if path.starts_with(dir.as_os_str().as_bytes()) {
             return true;
         }
 
@@ -582,22 +588,23 @@ fn is_path_in_temp_dir(path: &[u8]) -> bool {
     false
 }
 
-/// `os/file.zig allocTmpDir` on POSIX (TMPDIR, TMP, then /tmp).
+/// `os/file.zig allocTmpDir` on POSIX (TMPDIR, TMP, then /tmp), as the raw
+/// OS string.
 #[cfg(not(windows))]
 #[allow(clippy::unnecessary_wraps)]
-fn alloc_tmp_dir() -> Option<String> {
+fn alloc_tmp_dir() -> Option<std::ffi::OsString> {
     for key in ["TMPDIR", "TMP"] {
         if let Some(v) = std::env::var_os(key) {
-            return Some(v.to_string_lossy().into_owned());
+            return Some(v);
         }
     }
-    Some("/tmp".to_owned())
+    Some("/tmp".into())
 }
 
 /// `os/file.zig allocTmpDir` on Windows (`TMP` only).
 #[cfg(windows)]
-fn alloc_tmp_dir() -> Option<String> {
-    std::env::var_os("TMP").map(|v| v.to_string_lossy().into_owned())
+fn alloc_tmp_dir() -> Option<std::ffi::OsString> {
+    std::env::var_os("TMP")
 }
 
 /// Image represents a single fully loaded image.
@@ -655,6 +662,23 @@ pub struct Rect {
 
 #[cfg(test)]
 mod tests {
+    #[cfg(unix)]
+    #[test]
+    fn temp_dir_check_keeps_non_utf8_tmpdir_bytes() {
+        use std::os::unix::ffi::OsStringExt;
+        let dir = std::ffi::OsString::from_vec(b"/data/t\xffmp".to_vec());
+        assert!(is_path_in_temp_dir_with(
+            b"/data/t\xffmp/tty-graphics-protocol-x",
+            Some(dir.clone())
+        ));
+        // A lossy conversion would have turned the byte into U+FFFD.
+        assert!(!is_path_in_temp_dir_with(
+            b"/data/t\xef\xbf\xbdmp/tty-graphics-protocol-x",
+            Some(dir)
+        ));
+        assert!(!is_path_in_temp_dir_with(b"/data/x", None));
+    }
+
     use ghostty_vt::kitty::graphics_command::{Control, Transmission};
 
     use super::*;

crates/ghostty-terminal/src/stream_readonly.rs

@@ -185,9 +185,9 @@ impl<'a> Handler<'a> {
         Ok(())
     }
 
-    fn color_operation(&mut self, requests: &osc_color::List) {
-        for req in requests {
-            match *req {
+    fn color_operation(&mut self, requests: &osc_color::List<'_>) {
+        for req in requests.iter() {
+            match req {
                 Request::Set(set) => match set.target {
                     Target::Palette(i) => {
                         self.terminal.flags.dirty.palette = true;
@@ -231,10 +231,10 @@ impl<'a> Handler<'a> {
         }
     }
 
-    fn kitty_color_operation(&mut self, request: &kitty::color::OSC) {
+    fn kitty_color_operation(&mut self, request: &kitty::color::OSC<'_>) {
         use kitty::color::{Kind, Request as KReq, Special};
-        for item in &request.list {
-            match item {
+        for item in request.list.iter() {
+            match &item {
                 KReq::Set { key, color } => match key {
                     Kind::Palette(palette) => {
                         self.terminal.flags.dirty.palette = true;