feat(parity): rsync 3.4.1 checksum/timeout/temp-dir/connectivity parity (#289 #295 #296)

#289 checksum/compression:
- -c/--checksum now implies the incremental content quick-check (without
  implying -t), so an unchanged file is skipped like rsync.
- --checksum-choice/--cc accepts xxh64/xxhash, xxh3, xxh128, md5 and auto;
  md4/sha1/none and the two-name form are rejected by name.
- --compress-choice/--zc rejects lz4/zlib/zlibx by name (zstd/none/auto kept).
- --checksum-seed=0 is randomized per transfer and sent on the wire.
- --skip-compress uses rsync 3.4.1's default suffix list; slash separators and
  dot-less suffixes are accepted.
- add --no-whole-file.

#295 timeouts/alloc/temp-dir:
- --timeout default 0 (disabled), --contimeout default 60; 0 disables both,
  plus --no-timeout/--no-contimeout.
- --max-alloc=0 means no allocation limit (was rejected).
- --temp-dir accepts any dir, requires it to exist, and falls back to a
  non-atomic copy on EXDEV instead of aborting.

#296 connectivity/daemon:
- -M/--remote-option is rejected for daemon/TCP destinations (SSH-only).
- --trust-sender clarified as receiver-local; server-path tests added.
- --stop-at accepts rsync's full date form (y-m-dTh:m etc.).

Adds unit and integration coverage; no wire-field change, PROTOCOL_VERSION stays
2.22.0.

src/shared/file.h

@@ -86,19 +86,23 @@ bool file_rename_secure(const char* old_path, const char* new_path);
    regular file.  See the .c for the exact success semantics. */
 bool file_remove_tree_secure(const char* path);
 /* Open a private 0700 directory (creating it on demand) that must live below
-   the authorized root.  Used for the --temp-dir scratch directory and the
-   --delay-updates staging directory. */
+   the authorized root.  Used for the --delay-updates staging directory. */
 int file_open_private_dir(const char* dir_path);
 
+/* Open an existing --temp-dir scratch directory as-is (absolute or relative;
+   no creation, no root confinement), matching rsync's --temp-dir handling. */
+int file_open_temp_dir(const char* dir_path);
+
 /* The file_to_disk_secure* variants write a temporary copy in the destination
-   directory and atomically rename it over `path`.  temp_dir is an absolute,
-   root-confined scratch directory (already validated by the caller): when it
-   is non-NULL the temporary copy is instead created there (with a name unique
-   across the whole scratch directory) and atomically renamed into the
-   destination directory once fully written and fsynced.  A rename across
-   filesystems (EXDEV) fails the write with an error; the file is never
-   silently copied into place.  Pass NULL for the historical same-directory
-   behavior.  --inplace writes never use temp_dir. */
+   directory and atomically rename it over `path`.  temp_dir is a scratch
+   directory (an absolute path, or one the caller already resolved against the
+   destination root): when it is non-NULL the temporary copy is instead created
+   there (with a name unique across the whole scratch directory) and atomically
+   renamed into the destination directory once fully written and fsynced.  When
+   that rename/link fails with EXDEV (the scratch dir is on another filesystem)
+   the write falls back to a non-atomic copy directly in the destination
+   directory, matching rsync.  Pass NULL for the same-directory behavior.
+   --inplace writes never use temp_dir. */
 bool file_to_disk_secure(const char* path, const void* data, unsigned long long data_size,
                          bool inplace, bool sparse, bool preallocate, const FileMetadata* metadata,
                          FileAttrPolicy policy, const char* temp_dir);