fix(delete): match rsync deletion semantics (#290)

- Scope the --delete extras walk to directories synchronized by the
  transfer: add a synchronized-directory section to the delete manifest
  (protocol 2.23.0) so --files-from subsets no longer delete untransmitted
  paths outside listed directory subtrees (data-loss fix).
- Separate --max-size/--min-size prune protection from --delete-excluded so
  size-pruned source mirrors survive (rsync parity).
- Unlink extraneous destination symlinks instead of skipping them.
- Make --max-delete partial (delete up to N, skip the rest) and exit 25;
  accept negative values as unlimited.
- Draw --delete-missing-args deletions from the shared --max-delete budget.
- Honor --force during --delay-updates publication.

Add unit and integration regression tests; update the pinned config wire
golden and version strings for the 2.23.0 manifest/status additions.

tests/test_config.c

@@ -2665,14 +2665,14 @@ static void golden_config_populate(Config* c) {
   c->copy_as_gid = 222;
 }
 
-/* The pinned golden frame (protocol 2.22.0).  The values below are the only
+/* The pinned golden frame (protocol 2.23.0).  The values below are the only
  * thing that ties the generated table to the historical wire format; update
- * them ONLY with a PROTOCOL_VERSION bump and a documented reason.  The 2.22.0
- * preserve-attribute split appends four serialized bools
- * (preserve_perms/times/owner/group) to CONFIG_WIRE_METADATA_TIMES_FIELDS after
- * omit_link_times. */
+ * them ONLY with a PROTOCOL_VERSION bump and a documented reason.  The 2.23.0
+ * delete-semantics wave keeps the config-frame LAYOUT unchanged, but the
+ * embedded version string moves to "2.23.0", so the byte-exact hash changes
+ * while the length stays 653. */
 #define GOLDEN_WIRE_LEN 653
-#define GOLDEN_WIRE_HASH 95530566005420798ULL
+#define GOLDEN_WIRE_HASH 3267254725292157519ULL
 
 static unsigned long long fnv1a_64(const unsigned char* buf, size_t len) {
   unsigned long long h = 1469598103934665603ULL;
@@ -2754,7 +2754,7 @@ static unsigned long long capture_wire_hash(const Config* cfg, size_t* out_len)
   return h;
 }
 
-/* Byte-for-byte wire compatibility guard (protocol 2.22.0).  The expected hash
+/* Byte-for-byte wire compatibility guard (protocol 2.23.0).  The expected hash
  * pins the pre-X-macro byte stream; the refactor MUST NOT change it. */
 static void test_config_wire_golden() {
   if (is_running_under_valgrind())