fix(identity): rsync ownership parity for numeric-ids, dirs, maps, fake-super (#286, #294)

- #286: --numeric-ids is a mapping modifier only; it no longer activates
  chown by itself (identity_active_enabled/owner/group predicates), and
  --fake-super stores the resolved mapping instead of real-chowning.
- #286: apply owner/group to directories via the deferred directory
  metadata path; capture+transmit+apply directory xattrs/ACLs (-aX/-aA),
  including default ACLs, in STATUS_MKDIR/STATUS_DIR_TIMES.
- #294: --usermap/--groupmap support inclusive ranges, '*', empty FROM
  (unnamed ids), and receiver-side TO name resolution; --chown mixing with
  a same-side map is rejected like rsync.
- Protocol 2.22.0 -> 2.23.0 (map wire entry gains from_hi + to_name;
  dir frames gain a bounded xattr block).

src/shared/xattr.h

@@ -56,6 +56,8 @@ typedef struct {
 
 FileXattrList* xattr_list_new(void);
 void xattr_list_free(FileXattrList* list);
+/* Deep-copy `list` (NULL in, NULL out).  Returns NULL on allocation failure. */
+FileXattrList* xattr_list_clone(const FileXattrList* list);
 /* Append one entry (deep copy).  Returns false on allocation failure. */
 bool xattr_list_append(FileXattrList* list, const char* name, const void* value, size_t value_len);
 
@@ -96,17 +98,16 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
                          int64_t mtime_nsec);
 
 /* --fake-super replay: parse the FAKESUPER_XATTR record previously written on
- * `fd` by fake_super_store_fd and re-apply uid/gid/mode/mtime fd-relative.
- * Best-effort: absence of the xattr or a malformed record is a silent no-op
- * that never fails the transfer.  The OWNER leg is applied only when an explicit
- * ownership identity policy is active (numeric-ids/chown/usermap/groupmap/
- * copy-as/-o/-g), when super-user activities are permitted, and when --copy-as
- * is not authoritative; a non-root EPERM/EACCES is skipped silently, matching
- * FastSync's identity philosophy.  The MODE leg is applied only when
- * policy.perms||policy.executability and the MTIME leg only when policy.times,
- * so the fake-super replay cannot bypass the per-attribute split; the mode is
- * sanitized exactly like the normal metadata path (group/other write bits never
- * granted).  Returns true when the xattr was present and parsed. */
+ * `fd` by fake_super_store_fd and re-apply mode/mtime fd-relative.  The
+ * recorded uid/gid are deliberately NOT chowned for real: --fake-super only
+ * RECORDS ownership (the caller stores the resolved mapping via
+ * identity_resolve_storage_ids), it never performs a real chown.  Best-effort:
+ * absence of the xattr or a malformed record is a silent no-op that never fails
+ * the transfer.  The MODE leg is applied only when policy.perms||policy.
+ * executability and the MTIME leg only when policy.times, so the fake-super
+ * replay cannot bypass the per-attribute split; the mode is sanitized exactly
+ * like the normal metadata path (group/other write bits never granted).
+ * Returns true when the xattr was present and parsed. */
 bool fake_super_restore_fd(int fd, FileAttrPolicy policy);
 
 #endif