feat: --append / --append-verify tail-only resume

Implement rsync's append modes: when an existing destination file is SHORTER
than the source, the receiver negotiates a resume offset and only the tail is
transferred; the full file (retained prefix + tail) is rebuilt and installed
through the normal atomic store path, so the result is byte-identical to the
source whenever the prefix matches.

- --append: sends the tail without content-verifying the retained prefix
  (rsync parity; the documented prefix-trust risk).
- --append-verify: verifies the retained prefix against the source's prefix
  xxHash64 before appending and, on a mismatch, falls back to a clean full
  transfer (never a corrupt prefix+tail blend).

New wire frames STATUS_APPEND / STATUS_APPEND_SIG / STATUS_APPEND_OK /
STATUS_APPEND_DATA; PROTOCOL_VERSION bumped 2.9.0 -> 2.10.0 (peers must match).
Both flags imply --incremental and are incompatible with -s (chunk
serialization) and --whole-file (rejected up front). Respects --inplace,
--partial/--partial-dir and --delay-updates via the shared store engine.

src/shared/protocol.c

@@ -397,6 +397,14 @@ static const char* status_to_string(Status status) {
     return "CHECK_BATCH";
   case STATUS_MKDIR:
     return "MKDIR";
+  case STATUS_APPEND:
+    return "APPEND";
+  case STATUS_APPEND_SIG:
+    return "APPEND_SIG";
+  case STATUS_APPEND_OK:
+    return "APPEND_OK";
+  case STATUS_APPEND_DATA:
+    return "APPEND_DATA";
   default:
     return "UNKNOWN";
   }