fix(parity): empty-dir delete, per-dir filter errors, -R protect, stats parser

Blockers addressed together (shared scanner/delete-plan plumbing):

* #10: an empty in-scope source directory produced no plan keep entry, so the
  receiver deleted the destination directory itself.  The scanner now records
  every traversed directory into a delete-plan sink, the plan sender keeps them,
  and any directory whose plan the data stream never triggered is emitted after
  the data so its extras are still removed.  Differential tests cover
  --delete-during and --delete-delay.
* #8: an invalid per-directory filter file was silently ignored when an earlier
  merge file in the same directory existed; key the failure off the error text
  (both sequential and parallel scanners) and fail the scan.
* #9: -R + --files-from receiver-protect rules recorded the source-relative
  path; record the bare relative wire path in both scanners so the protected
  destination mirror survives --delete.
* #5: the STATUS_STATS would-delete parser now validates each retained path and
  enforces the shared MAX_MANIFEST_BYTES budget, and the --out-format dry-run
  delete line is escaped like the itemize line.
* #11: drop the unused DELETE_PLAN_MAX_NAMES macro, log the delete-limit
  warning once per session, roll back dir-merge names from a per-directory file
  that fails to parse, and guard every filter error snprintf against err==NULL.

#10 leaves the empty directory itself kept and its extras removed, matching
rsync's final state on both per-directory timings.

src/shared/delete_plan.h

@@ -54,6 +54,10 @@ int delete_plan_send_root(int fd, DeletePlanSender* sender);
 /* Send the plans for every ancestor of `path` (root-first) and, when is_dir,
  * for `path` itself; already-sent plans are skipped. */
 int delete_plan_send_for_path(int fd, DeletePlanSender* sender, const char* path, bool is_dir);
+/* Send the plan for every directory in `dirs` that has not been transmitted
+ * yet.  Called after the data stream so an empty source directory's plan still
+ * clears its destination extras even though no file frame triggered it. */
+int delete_plan_send_remaining(int fd, DeletePlanSender* sender, const ArrayList* dirs);
 
 /* ---- Receiver: delete session ---- */