feat(p7-output-fs): sparse hole preservation (-S), partial retention (-P), fake-super replay; block-size verified; crtimes/stderr -> Impossible/Divergence (Wave B)

- write_all_sparse: skips all-zero runs >= 4096 bytes via lseek(SEEK_CUR) and
  ftruncates the final size, wired into the atomic temp+rename and --inplace
  paths with no wire change (full image already in memory).
- --partial retention: on a save failure after the temp held data, rename the
  already-written temp to the destination path (best-effort; falls through to
  unlink; never retains when --partial is off) so --append/--append-verify can
  resume; tested by forcing futimens EINVAL with an out-of-range nsec.
- --block-size aliases --delta-block; verified config->delta_block_size is
  honored by the delta engine end-to-end (unit + integration tests).
- fake_super_restore_fd: parses and re-applies user.fastsync.stat fd-relative
  (fchown best-effort/non-root skipped, fchmod, futimens); a save under
  --fake-super now both records and re-applies.
- -N/--crtimes and --stderr=client promoted to a new 'Impossible/Divergence'
  status bucket (Summary: 136/2/4/3/2 = 147).
- cppcheck/clang-format clean; unit 37/37; integration 407 passed.

src/shared/xattr.c

@@ -9,7 +9,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
 #include <sys/xattr.h>
+#include <time.h>
+#include <unistd.h>
 
 /* ---- lifecycle ---- */
 
@@ -328,4 +331,40 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
     log_message(LOG_LEVEL_WARNING, "--fake-super: could not store %s on destination file: %s",
                 FAKESUPER_XATTR, strerror(errno));
   }
+}
+
+/* --fake-super replay: read the freshly-stored record and re-apply the source
+ * stat fd-relative.  A privileged (root) run can actually change the owner;
+ * a non-root run logs-and-skips the fchown (never fatal, mirroring the normal
+ * metadata identity path) and still applies mode/mtime where permitted. */
+bool fake_super_restore_fd(int fd) {
+  if (fd < 0)
+    return false;
+  char record[128];
+  ssize_t len = fgetxattr(fd, FAKESUPER_XATTR, record, sizeof(record) - 1);
+  if (len < 0)
+    return false; /* absent or filesystem without xattrs: silent no-op */
+  record[len] = '\0';
+  unsigned long ul_uid, ul_gid, ul_mode;
+  long long mtime_sec;
+  long mtime_nsec;
+  if (sscanf(record, "%lu:%lu:%lo:%lld:%ld", &ul_uid, &ul_gid, &ul_mode, &mtime_sec, &mtime_nsec) !=
+      5)
+    return false; /* malformed record: skip, never fatal */
+
+  /* Owner is applied best-effort only: a non-root process cannot chown and must
+     not abort the transfer for that reason (FastSync identity philosophy). */
+  if (fchown(fd, (uid_t)ul_uid, (gid_t)ul_gid) != 0 && errno != EPERM && errno != EACCES &&
+      errno != EINVAL)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore owner on destination file: %s",
+                strerror(errno));
+  if (fchmod(fd, (mode_t)(ul_mode & 07777U)) != 0)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore mode on destination file: %s",
+                strerror(errno));
+  struct timespec times[2] = {{.tv_sec = 0, .tv_nsec = UTIME_OMIT},
+                              {.tv_sec = (time_t)mtime_sec, .tv_nsec = mtime_nsec}};
+  if (futimens(fd, times) != 0)
+    log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore mtime on destination file: %s",
+                strerror(errno));
+  return true;
 }