fix(receiver): confine --temp-dir scratch dir and gate setuid bits

Three receiver security fixes from the audit:

1. --temp-dir symlink escape (High): file_open_temp_dir() opened the
   client-controlled scratch dir with a bare open(), so a symlink planted
   under the receive root let a peer redirect receiver scratch files
   outside the authorized root.  The opened dir is now judged by the REAL
   path of its fd (via /proc/self/fd), and any target outside the
   authorized receive root is refused with a logged error (EACCES).  An
   in-root symlink (the EXDEV cross-filesystem fallback case) still works,
   and the no-root local batch path is unchanged.

2. setuid/setgid/sticky under SUPER_MODE_OFF (High): the special bits were
   applied under --perms (and via --chmod) even when the connection forbade
   super-user activities.  FileAttrPolicy gains super_permitted, set by
   file_attr_policy_from_config() from privilege_super_mode_permitted();
   metadata_mode_for_policy(), the symlink path, the special-node creation
   path, and the deferred directory-mode apply now strip the special bits
   when it is false.  Exact rsync semantics are preserved when permitted.

3. daemon umask (Low): daemonize() forced umask(0), so implied parent
   directories created without -p were world-writable 0777.  Set the
   conventional daemon umask 022 instead (rsync never forces 0); -p/-a mode
   preservation is unaffected because it restores modes via fchmod.

Tests: new unit tests for file_open_temp_dir confinement and the
masked/unmasked special-bit policy (incl. the --chmod path), a daemon
world-writable-dir regression test, an integration escape test, and a
root-only integration test asserting special bits are masked without
--allow-super.  The old cross-filesystem test encoded the vulnerable
behavior (symlink target outside the root) and is replaced by the escape
test; the EXDEV fallback code is retained for in-root links.

src/shared/file_attr.h

@@ -29,6 +29,12 @@ typedef struct FileAttrPolicy {
   bool times;         /* config->preserve_times: apply the source mtime */
   bool atimes;        /* config->preserve_atimes (-U): apply the source atime */
   bool executability; /* config->use_executability (-E): exec-bits-only mode */
+  /* privilege_super_mode_permitted(): when false (SUPER_MODE_OFF / --no-super,
+     or a daemon that did not grant `client owner = yes`), the setuid/setgid/
+     sticky bits are stripped from every applied mode (source mode and any
+     --chmod result) even under --perms.  When true, rsync's exact semantics are
+     preserved: -p copies the special bits and the kernel decides. */
+  bool super_permitted;
 } FileAttrPolicy;
 
 /* Build the per-attribute policy from a connection's Config.  A NULL config