feat(delete): per-directory delete plans for --delete-during/--delete-delay (protocol 2.24.0)

Stream one delete plan per source directory from sender to receiver instead of
a single whole-tree keep-set manifest:

- --delete-during applies each directory's extras as its plan arrives, before
  that directory's data (rsync's generator-order deletion).
- --delete-delay snapshots each directory's extras while the plan arrives and
  commits the removals only after a fully-successful transfer, so files created
  after the scan survive (matching rsync's delete-delay, not delete-after).
- Type conflicts (a destination file blocking a source directory, or vice
  versa) are cleared immediately in both modes, so the nested write succeeds.

The plan carries the destination-relative directory, its kept child directory
names and its kept child file names; the first frame also carries the global
protected prefixes, size-skipped prefixes and --delete-missing-args paths.
--delete-before keeps the existing whole-tree early manifest; plain --delete and
--delete-after keep the end-of-transfer manifest commit.

Preserves the existing safety surface: protected/size-skipped prefixes and the
--delay-updates/basis skips are honored at any depth, deletion is scoped to the
synchronized directories (--files-from), MAX_SERVER_DELETE_COUNT and
--max-delete (partial + exit 25) are shared across plans, symlinks are never
followed, and paths are confined to the receive root.

src/shared/protocol.h

@@ -181,7 +181,21 @@ enum NET_STATUS {
    * (new vs modified, and which of size/time/perms/owner/group differ) without
    * changing the transfer decision itself.  Appended after
    * STATUS_DELETE_LIMIT so no existing status is renumbered. */
-  STATUS_DEST_INFO
+  STATUS_DEST_INFO,
+  /* Per-directory delete plan (protocol 2.24.0).  The sender of a
+   * --delete-during/--delete-delay transfer streams one frame per source
+   * directory in directory order instead of a single whole-tree keep-set
+   * manifest.  The receiver applies the plan when it arrives
+   * (--delete-during removes that directory's extras immediately) or records
+   * the extras and applies them only after the whole transfer succeeded
+   * (--delete-delay).  Payload: an int32 has_config flag (1 on the first plan
+   * of the run, 0 afterwards); when set, the three global config sections
+   * (protected-prefix count+paths, size-skipped count+paths, missing-args
+   * count+paths); then the destination-relative directory path wire string
+   * ("." for the receive root); then the child-directory count + names and the
+   * child-file count + names that must be kept.  Appended after
+   * STATUS_DEST_INFO so no existing status is renumbered. */
+  STATUS_DELETE_PLAN
 };
 
 void io_set_fds(int read_fd, int write_fd);