symlink-trust: -k/--copy-dirlinks, -K/--keep-dirlinks, --munge-links (+real -l/--links)

Adds symlink-target transmission (File is_symlink+symlink_target, STATUS_SYMLINK
frame, chunk type 2), munge-links sender containment + receiver-side symmetric
target containment, keep-dirlinks confined dir-symlink following (O_NOFOLLOW
realpath-rechecked), and fixes -l to copy symlinks as symlinks. munge_links +
keep_dirlinks cross the wire; copy_dirlinks client-only. PROTOCOL_VERSION
2.12.0->2.13.0. Review fixes: receiver rejects absolute/.. targets, gated unmunge,
-K O_NOFOLLOW+re-fstat, keep_dirlinks set once at config-accept, rel_buf overflow
fails the walk.

src/server/receiver.c

@@ -154,7 +154,8 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
   DeleteManifest* deferred_manifest = NULL;
   while (status == STATUS_NEXT || status == STATUS_CHUNK || status == STATUS_CHECK ||
          status == STATUS_KEEPALIVE || status == STATUS_ABORT || status == STATUS_CHECK_BATCH ||
-         status == STATUS_MKDIR || status == STATUS_MANIFEST || status == STATUS_HARDLINK) {
+         status == STATUS_MKDIR || status == STATUS_MANIFEST || status == STATUS_HARDLINK ||
+         status == STATUS_SYMLINK) {
     if (status == STATUS_KEEPALIVE) {
       if (!send_status(file_descriptor, STATUS_KEEPALIVE))
         goto fail;
@@ -185,6 +186,10 @@ int receiver_process_pending(Config* config, int file_descriptor, const Receiver
       File* file = file_receive_hardlink(file_descriptor);
       if (!file || !sink->store_file(file, sink->context))
         goto receive_error;
+    } else if (status == STATUS_SYMLINK) {
+      File* sym = file_receive_symlink(file_descriptor, config);
+      if (!sym || !sink->store_file(sym, sink->context))
+        goto receive_error;
     } else if (status == STATUS_MANIFEST) {
       DeleteManifest* manifest = receive_manifest_entries(file_descriptor);
       if (!manifest)

src/server/server.c

@@ -215,6 +215,11 @@ void handler(int file_descriptor) {
      apply path.  Each connection is its own forked process, so this
      per-process snapshot never races another connection. */
   identity_set_active(config);
+  /* Persist the negotiated --keep-dirlinks policy once, here at config-accept,
+     before any multithreaded receiver/writer threads are spawned, so the
+     fd-walk reads a stable value during the whole transfer (and never bleeds
+     across the per-connection forked processes). */
+  file_set_keep_dirlinks(config->keep_dirlinks);
   if (config->use_multithreading) {
     Queue* q = queue_create(100, file_destroy);
     if (q == NULL) {