fix: --delay-updates delete/backup collisions, publish-failure test, staging lock

Review fixes for --delay-updates:

- --delete no longer deletes the staged files: the delete walker gains a
  skip_root_child parameter and receive_manifest passes DELAY_UPDATES_STAGING_DIR
  when delay_updates is active, so deletion removes genuine extras while the
  staging dir (a direct child of the receive root) is left for publication in
  both single and -m modes.
- --backup-dir is rejected when it collides with the reserved internal staging
  name .fastsync-stage (trailing slash normalized), in client validation and in
  the received-config wire validation, preventing old backups from being
  silently installed as new files.
- Staging dir is now held under an exclusive advisory flock for the whole
  transfer (context lifetime): two simultaneous delayed transfers to one
  destination root no longer share/destroy each other's staged data - the
  second fails cleanly.  Cleanup only touches the staging dir when this context
  owns the lock, so a lock-contention failure cannot wipe a live session.
- Post-publish staging cleanup now returns/logs instead of discarding failures
  (warning when the staging dir cannot be fully removed).
- Reworked the publish-failure integration test to exercise real mid-publish
  semantics (top-level file published, nested rename fails, no rollback,
  sources retained under --remove-source-files) and added integration tests for
  --delete + --delay-updates ordering and reserved --backup-dir rejection.
- RSYNC_COMPAT note documents delete ordering, the reserved-name hazard, and
  the concurrency guard.

src/shared/delay_updates.h

@@ -28,12 +28,18 @@ typedef struct DelayUpdatesContext {
   StagedFileEntry* entries;
   size_t count;
   size_t capacity;
-  bool prepared; /* staging dir created and stale leftovers wiped once */
+  bool prepared; /* staging dir created, wiped, and exclusively locked */
+  int lock_fd;   /* advisory exclusive flock held on the staging dir, or -1 */
 } DelayUpdatesContext;
 
 /* Name of the private staging subdirectory created under the receive root. */
 #define DELAY_UPDATES_STAGING_DIR ".fastsync-stage"
 
+/* True when `dir` (ignoring a trailing "/") is the reserved staging directory
+   name.  Used to reject a --backup-dir that would collide with the internal
+   staging area. */
+bool delay_updates_staging_name_conflict(const char* dir);
+
 /* Create an empty staging context rooted below root_directory.  Does not touch
    the filesystem yet. */
 DelayUpdatesContext* delay_updates_context_create(const char* root_directory);