docs: refresh README against implementation and guard against drift

Bring README.md and RSYNC_COMPAT.md in line with the actual code/CLI and add
an automated guard so they cannot silently drift again.

Waves A-E:
- Correct stale compatibility claims: archive is `-rlptD` (owner/group are
  opt-in via identity flags, not implied), and symlinks, hard links, xattrs,
  ACLs and `--dirs` are implemented.
- Remove documented-but-nonexistent features: the six unread FASTSYNC_* env
  vars, and `--client-cn` (server-only) from the client table.
- Repair the corrupted "Implementation Details" section (broken list numbering
  and emphasis) and correct it against the source.
- Sync the client and server option tables with usage.c / server_cli.c, and
  document server-contacting `--dry-run` (protocol 2.21.0).
- Hygiene: `# FastSync` heading, real build commands, consistent binary names,
  runnable TLS examples, daemon module keys.

Also align the client `--help` / archive log wording and the RSYNC_COMPAT
archive rows with the opt-in ownership model, and add
tests/integration/test_readme_consistency.py (marked `ci`) asserting every
documented FASTSYNC_* var is read in src/ and every documented client/server
flag appears in the corresponding `--help`.

src/client/client_cli.c

@@ -1195,17 +1195,20 @@ static bool cli_handle_meta_flags(CliParseCtx* ctx) {
     return true;
   }
   if (opt_is(arg, "-a", "--archive")) {
-    /* Real rsync archive (-rlptgoD).  FastSync is always recursive and always
+    /* FastSync archive mode (-rlptD).  FastSync is always recursive and always
      * preserves hard-link/other transfer semantics per its own flags, so -a
-     * implies links, full metadata (perms/times/group/owner as FastSync's
-     * broad bundle), devices and specials.  Compression and multithreading
-     * are NOT implied (they are no longer part of archive mode). */
+     * implies links, metadata (perms/times), devices and specials.  Owner/group
+     * are NOT implied; they require an explicit identity flag
+     * (--numeric-ids/--usermap/--groupmap/--chown/--copy-as).  Compression and
+     * multithreading are NOT implied either (they are no longer part of
+     * archive mode). */
     config->follow_symlinks = true;
     config->use_metadata = true;
     config->preserve_devices = true;
     config->preserve_specials = true;
     log_info_message(LOG_INFO_MISC,
-                     "Enabled archive mode (-rlptgoD: links, metadata, devices, specials)");
+                     "Enabled archive mode (-rlptD: links, metadata, devices, specials; "
+                     "owner/group opt-in)");
     return true;
   }
   if (opt_is(arg, "-p", "--perms")) {