feat: per-attribute preservation flags -p/-t/-o/-g with --no-* negations (protocol 2.22.0)

Split FastSync's single use_metadata bundle into four independent rsync-parity attributes: preserve_perms, preserve_times, preserve_owner, preserve_group. use_metadata is now a derived transport bit (config_derived_use_metadata).

CLI: real -p/--perms, -t/--times, -o/--owner, -g/--group plus --no-perms/--no-times/--no-owner/--no-group (short and long) and --no-preserve; -a is now rsync -rlptgoD; --preserve = -pt; -A implies -p; -X does not; --chmod implies -p; --usermap/--groupmap/--chown imply owner/group per side; --incremental/--delta still auto-preserve unless negated.

Receiver: per-attribute FileAttrPolicy gating for files, dirs (modes applied at end of transfer), symlinks and specials; rsync -E read-bit rule; new files get source_mode & ~umask sanitized (no group/other write); per-side identity resolution; deferred directory metadata; batch dir-metadata replay; daemon modules without 'client owner = yes' no longer refuse plain -a but force super off (no ownership) with a warning.

Wire: PROTOCOL_VERSION 2.21.0 -> 2.22.0 (four appended config bools, golden 653 / 95530566005420798). FileMetadata/chunk/batch framing unchanged. Docs/CHANGELOG/CMake updated to 2.22.0.

src/shared/xattr.h

@@ -1,6 +1,7 @@
 #ifndef XATTR_H
 #define XATTR_H
 
+#include "file_attr.h"
 #include <stdbool.h>
 #include <stddef.h>
 #include <stdint.h>
@@ -99,11 +100,13 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
  * Best-effort: absence of the xattr or a malformed record is a silent no-op
  * that never fails the transfer.  The OWNER leg is applied only when an explicit
  * ownership identity policy is active (numeric-ids/chown/usermap/groupmap/
- * copy-as), when super-user activities are permitted, and when --copy-as is not
- * authoritative; a non-root EPERM/EACCES is skipped silently, matching
- * FastSync's identity philosophy.  The mode is sanitized exactly like the normal
- * metadata path (group/other write bits never granted).  Returns true when the
- * xattr was present and parsed. */
-bool fake_super_restore_fd(int fd);
+ * copy-as/-o/-g), when super-user activities are permitted, and when --copy-as
+ * is not authoritative; a non-root EPERM/EACCES is skipped silently, matching
+ * FastSync's identity philosophy.  The MODE leg is applied only when
+ * policy.perms||policy.executability and the MTIME leg only when policy.times,
+ * so the fake-super replay cannot bypass the per-attribute split; the mode is
+ * sanitized exactly like the normal metadata path (group/other write bits never
+ * granted).  Returns true when the xattr was present and parsed. */
+bool fake_super_restore_fd(int fd, FileAttrPolicy policy);
 
 #endif