identity mapping: --numeric-ids / --usermap / --groupmap / --chown

Receiver-side ownership application, opt-in and privilege-gated:
- OFF for every existing transfer (plain -M/--preserve still never applies
  ownership); only triggers on an explicit identity flag + receiver permission.
- EPERM/EACCES warn-and-continue (never aborts); other fchown errors escalate.
- fd-relative fchown after the file is written (symlink-safe, confined).
- New src/shared/identity.{c,h}; config fields numeric_ids / chown uid/gid /
  usermap + groupmap id-pair tables cross the wire; PROTOCOL_VERSION 2.10.0
  -> 2.11.0. CLI in client_cli.c; per-connection snapshot in server.c.
- Review fixes: EPERM/EACCES-only warn-and-continue, prominent root-receiver
  notice, identity_clear_active on early server error paths, --numeric-ids
  kept inert standalone (removed from activation trigger set).

src/client/usage.c

@@ -129,6 +129,19 @@ void print_usage(void) {
   printf("  -M, --preserve      Preserve file metadata\n");
   printf("  -E, --executability Preserve executable permission bits\n");
   printf("  --chmod <changes>   Modify transferred permissions (rsync syntax)\n");
+  printf("  --numeric-ids       Do not map uid/gid by name: use the source numeric\n");
+  printf("                      ids directly when applying ownership\n");
+  printf("  --usermap=MAP       Map usernames when applying ownership: comma-separated\n");
+  printf("                      FROM:TO rules, first match wins.  FROM/TO are names\n");
+  printf("                      (resolved on the source machine), * (match any /\n");
+  printf("                      current user), or @N numeric ids.  e.g. *:nobody\n");
+  printf("  --groupmap=MAP      Map group names when applying ownership (same syntax)\n");
+  printf("  --chown=USER:GROUP  Override the ownership of transferred files.  Forms:\n");
+  printf("                      USER:GROUP, USER (owner only), :GROUP (group only); a\n");
+  printf("                      value of * means the current/root user as appropriate.\n");
+  printf("                      Names resolve on the source machine; @N for numerics.\n");
+  printf("                      Note: -M is already FastSync's preserve flag; these use\n");
+  printf("                      long forms only.\n");
   printf("  --chunk-size <n>    Chunk size in bytes (default: %d)\n", DEFAULT_CHUNK_SIZE);
   printf("  --source-dir <path> Source directory\n");
   printf("  --dest-dir <path>   Destination directory\n");