docs: refresh README against implementation and guard against drift

Bring README.md and RSYNC_COMPAT.md in line with the actual code/CLI and add
an automated guard so they cannot silently drift again.

Waves A-E:
- Correct stale compatibility claims: archive is `-rlptD` (owner/group are
  opt-in via identity flags, not implied), and symlinks, hard links, xattrs,
  ACLs and `--dirs` are implemented.
- Remove documented-but-nonexistent features: the six unread FASTSYNC_* env
  vars, and `--client-cn` (server-only) from the client table.
- Repair the corrupted "Implementation Details" section (broken list numbering
  and emphasis) and correct it against the source.
- Sync the client and server option tables with usage.c / server_cli.c, and
  document server-contacting `--dry-run` (protocol 2.21.0).
- Hygiene: `# FastSync` heading, real build commands, consistent binary names,
  runnable TLS examples, daemon module keys.

Also align the client `--help` / archive log wording and the RSYNC_COMPAT
archive rows with the opt-in ownership model, and add
tests/integration/test_readme_consistency.py (marked `ci`) asserting every
documented FASTSYNC_* var is read in src/ and every documented client/server
flag appears in the corresponding `--help`.

src/client/client_cli.c

@@ -1195,17 +1195,20 @@ static bool cli_handle_meta_flags(CliParseCtx* ctx) {
     return true;
   }
   if (opt_is(arg, "-a", "--archive")) {
-    /* Real rsync archive (-rlptgoD).  FastSync is always recursive and always
+    /* FastSync archive mode (-rlptD).  FastSync is always recursive and always
      * preserves hard-link/other transfer semantics per its own flags, so -a
-     * implies links, full metadata (perms/times/group/owner as FastSync's
-     * broad bundle), devices and specials.  Compression and multithreading
-     * are NOT implied (they are no longer part of archive mode). */
+     * implies links, metadata (perms/times), devices and specials.  Owner/group
+     * are NOT implied; they require an explicit identity flag
+     * (--numeric-ids/--usermap/--groupmap/--chown/--copy-as).  Compression and
+     * multithreading are NOT implied either (they are no longer part of
+     * archive mode). */
     config->follow_symlinks = true;
     config->use_metadata = true;
     config->preserve_devices = true;
     config->preserve_specials = true;
     log_info_message(LOG_INFO_MISC,
-                     "Enabled archive mode (-rlptgoD: links, metadata, devices, specials)");
+                     "Enabled archive mode (-rlptD: links, metadata, devices, specials; "
+                     "owner/group opt-in)");
     return true;
   }
   if (opt_is(arg, "-p", "--perms")) {

src/client/usage.c

@@ -20,8 +20,9 @@ void print_usage(void) {
   printf("Options:\n");
   printf("  -c, --checksum      Verify content by checksum instead of size+mtime\n");
   printf("  -z, --compress [level]  Enable compression (level 1-22, default 5)\n");
-  printf("  -a, --archive       rsync archive mode (-rlptgoD): links, metadata,\n");
-  printf("                      devices and specials (not compression/multithreading)\n");
+  printf("  -a, --archive       rsync archive mode (-rlptD): links, perms, times,\n");
+  printf("                      devices and specials; owner/group are not implied;\n");
+  printf("                      not compression/multithreading\n");
   printf("  -n, --dry-run       Show what would be transferred\n");
   printf("  --remove-source-files  Remove regular source files after successful transfer\n");
   printf("  -p, --perms         Preserve permission bits (part of the metadata bundle)\n");
@@ -162,6 +163,9 @@ void print_usage(void) {
   printf("                      none suppresses info even with --verbose\n");
   printf("  --preserve          Preserve file metadata (long form only)\n");
   printf("  -E, --executability Preserve executable permission bits\n");
+  printf("  -U, --atimes        Preserve access times\n");
+  printf("  -N, --crtimes       Capture birth time; cannot be applied (documented\n");
+  printf("                      divergence)\n");
   printf("  -X, --xattrs        Preserve user extended attributes (user.* only;\n");
   printf("                      privileged security.*/trusted.* namespaces are\n");
   printf("                      never captured or applied)\n");