docs: refresh README against implementation and guard against drift

Bring README.md and RSYNC_COMPAT.md in line with the actual code/CLI and add
an automated guard so they cannot silently drift again.

Waves A-E:
- Correct stale compatibility claims: archive is `-rlptD` (owner/group are
  opt-in via identity flags, not implied), and symlinks, hard links, xattrs,
  ACLs and `--dirs` are implemented.
- Remove documented-but-nonexistent features: the six unread FASTSYNC_* env
  vars, and `--client-cn` (server-only) from the client table.
- Repair the corrupted "Implementation Details" section (broken list numbering
  and emphasis) and correct it against the source.
- Sync the client and server option tables with usage.c / server_cli.c, and
  document server-contacting `--dry-run` (protocol 2.21.0).
- Hygiene: `# FastSync` heading, real build commands, consistent binary names,
  runnable TLS examples, daemon module keys.

Also align the client `--help` / archive log wording and the RSYNC_COMPAT
archive rows with the opt-in ownership model, and add
tests/integration/test_readme_consistency.py (marked `ci`) asserting every
documented FASTSYNC_* var is read in src/ and every documented client/server
flag appears in the corresponding `--help`.

src/client/usage.c

@@ -20,8 +20,9 @@ void print_usage(void) {
   printf("Options:\n");
   printf("  -c, --checksum      Verify content by checksum instead of size+mtime\n");
   printf("  -z, --compress [level]  Enable compression (level 1-22, default 5)\n");
-  printf("  -a, --archive       rsync archive mode (-rlptgoD): links, metadata,\n");
-  printf("                      devices and specials (not compression/multithreading)\n");
+  printf("  -a, --archive       rsync archive mode (-rlptD): links, perms, times,\n");
+  printf("                      devices and specials; owner/group are not implied;\n");
+  printf("                      not compression/multithreading\n");
   printf("  -n, --dry-run       Show what would be transferred\n");
   printf("  --remove-source-files  Remove regular source files after successful transfer\n");
   printf("  -p, --perms         Preserve permission bits (part of the metadata bundle)\n");
@@ -162,6 +163,9 @@ void print_usage(void) {
   printf("                      none suppresses info even with --verbose\n");
   printf("  --preserve          Preserve file metadata (long form only)\n");
   printf("  -E, --executability Preserve executable permission bits\n");
+  printf("  -U, --atimes        Preserve access times\n");
+  printf("  -N, --crtimes       Capture birth time; cannot be applied (documented\n");
+  printf("                      divergence)\n");
   printf("  -X, --xattrs        Preserve user extended attributes (user.* only;\n");
   printf("                      privileged security.*/trusted.* namespaces are\n");
   printf("                      never captured or applied)\n");