fix(p8h): restore daemon --super refusal, race-free secret-file check, remaining log escapes

- server_module_gate: refuse client-chosen ownership against the ORIGINAL config
  so an explicit --super is still refused under an operator --no-super veto
  (the veto must not turn a refusal into an accept).
- credentials: open-then-fstat the exact secret inode, require current-user
  ownership and no group/other bits, but continue to allow process-substitution
  FIFOs; removes the stat->fopen TOCTOU.
- file.c preallocate + protocol.c send-string debug logs escape attacker paths.
- usage/RSYNC_COMPAT updated for --old-args no-op and secret-file rules.

src/client/usage.c

@@ -246,8 +246,8 @@ void print_usage(void) {
   printf("  -T, --temp-dir <dir>  Scratch dir for temp files before atomic install\n");
   printf("  --fastsync-server-path <path>\n");
   printf("                      Path to fastsync-server on remote (default: fastsync-server)\n");
-  printf(
-      "  --old-args          Disable safe SSH command argument quoting (legacy compatibility)\n");
+  printf("  --old-args          Accepted for rsync CLI compatibility; no effect (the\n");
+  printf("                      remote server path is always safely quoted now)\n");
   printf("  -M, --remote-option=OPT  Append OPT to the REMOTE server invocation over SSH\n");
   printf("                      (repeatable; each value is single-quote-escaped on the remote\n");
   printf("                      command line; empty values and values with control characters\n");