fix(identity): rsync ownership parity for numeric-ids, dirs, maps, fake-super (#286, #294)

- #286: --numeric-ids is a mapping modifier only; it no longer activates
  chown by itself (identity_active_enabled/owner/group predicates), and
  --fake-super stores the resolved mapping instead of real-chowning.
- #286: apply owner/group to directories via the deferred directory
  metadata path; capture+transmit+apply directory xattrs/ACLs (-aX/-aA),
  including default ACLs, in STATUS_MKDIR/STATUS_DIR_TIMES.
- #294: --usermap/--groupmap support inclusive ranges, '*', empty FROM
  (unnamed ids), and receiver-side TO name resolution; --chown mixing with
  a same-side map is rejected like rsync.
- Protocol 2.22.0 -> 2.23.0 (map wire entry gains from_hi + to_name;
  dir frames gain a bounded xattr block).

src/shared/xattr.c

@@ -38,6 +38,22 @@ void xattr_list_free(FileXattrList* list) {
   free(list);
 }
 
+FileXattrList* xattr_list_clone(const FileXattrList* list) {
+  if (!list)
+    return NULL;
+  FileXattrList* clone = xattr_list_new();
+  if (!clone)
+    return NULL;
+  for (int i = 0; i < list->count; i++) {
+    if (!xattr_list_append(clone, list->items[i].name, list->items[i].value,
+                           list->items[i].value_len)) {
+      xattr_list_free(clone);
+      return NULL;
+    }
+  }
+  return clone;
+}
+
 bool xattr_list_append(FileXattrList* list, const char* name, const void* value, size_t value_len) {
   if (!list || !name || (!value && value_len != 0))
     return false;
@@ -365,29 +381,11 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
   }
 }
 
-/* --fake-super replay: read the freshly-stored record and re-apply the source
- * stat fd-relative.  A privileged (root) run can actually change the owner;
- * a non-root run silently skips the fchown on EPERM/EACCES (never fatal,
- * mirroring the normal metadata identity path; other errors are logged) and
- * still applies mode/mtime where permitted.
- *
- * The OWNER leg additionally honors three policies:
- *   - an ownership identity policy must be active: the explicit flags
- *     (--numeric-ids / --chown / --usermap / --groupmap / --copy-as) OR the
- *     preserve-source -o/--owner / -g/--group requests.  --fake-super on its own
- *     only RECORDS the source owner; replaying that owner as a live chown
- *     without an ownership opt-in would be an un-gated client-chosen-ownership
- *     primitive.  The owner and group sides are applied INDEPENDENTLY (through
- *     identity_owner_requested()/identity_group_requested()), so a plain -o or
- *     -g touches only the requested side and passes (uid_t)-1 / (gid_t)-1 for
- *     the other.
- *   - --no-super (privilege_super_permitted() false) suppresses it even for a
- *     root receiver, exactly like the normal metadata identity path.
- *   - an active --copy-as is AUTHORITATIVE: the identity path already forced the
- *     target owner, so replaying the recorded source owner here would silently
- *     override it.  The xattr record is still stored/replayed for a later
- *     privileged restore; only the live chown is skipped.  Mode/mtime remain
- *     applied either way so unprivileged --fake-super still works. */
+/* --fake-super replay: read the freshly-stored record and re-apply mode/mtime
+ * fd-relative.  The recorded uid/gid are retained for a later privileged
+ * restore but are NEVER chowned here: --fake-super only RECORDS ownership, it
+ * must not real-chown the recorded (resolved) owner.  Mode/mtime still apply so
+ * unprivileged --fake-super keeps working. */
 bool fake_super_restore_fd(int fd, FileAttrPolicy policy) {
   if (fd < 0)
     return false;
@@ -403,22 +401,12 @@ bool fake_super_restore_fd(int fd, FileAttrPolicy policy) {
       5)
     return false; /* malformed record: skip, never fatal */
 
-  /* Owner is applied best-effort only: a non-root process cannot chown and
-     must not abort the transfer for that reason (FastSync identity philosophy).
-     EPERM/EACCES (expected for a non-root receiver) are skipped silently; a
-     genuine EINVAL (an impossible stored id) is logged so the corruption is
-     not hidden.  --no-super suppresses the owner leg even for root, and an
-     active --copy-as is authoritative so its forced owner must not be
-     overwritten by the recorded source owner. */
-  if (identity_active_enabled() && privilege_super_permitted() && !identity_copy_as_active()) {
-    /* Apply only the requested side(s): an unchosen side is passed as -1 so the
-     * kernel leaves it exactly as-is. */
-    uid_t owner = identity_owner_requested() ? (uid_t)ul_uid : (uid_t)-1;
-    gid_t group = identity_group_requested() ? (gid_t)ul_gid : (gid_t)-1;
-    if (fchown(fd, owner, group) != 0 && errno != EPERM && errno != EACCES)
-      log_message(LOG_LEVEL_WARNING,
-                  "--fake-super: could not restore owner on destination file: %s", strerror(errno));
-  }
+  /* --fake-super NEVER performs a real chown: that would defeat the whole
+     point of the flag (record privileged ownership on an unprivileged receiver
+     for a later privileged restore).  The uid/gid parsed above are retained in
+     the record for that later restore, but no ownership change happens here. */
+  (void)ul_uid;
+  (void)ul_gid;
   /* Mode is applied only when the per-attribute policy asks for it, through the
      SAME shared helper the normal metadata path uses (metadata_mode_for_policy):
      group/other write bits are never granted, so a recorded source mode of 0666