fix(p7-times): dir-time entries only record (never create dirs); bound/chunk dir-time frames; harden list add; docs+tests

Review fixes for Phase 7 Wave D.

#1 (HIGH): STATUS_DIR_TIMES entries no longer create directories. A new
receiver-only File.dir_time_only flag marks dir-time entries; file_save_to_disk_full
short-circuits them as FILE_SAVE_SKIPPED before any device/dir branch, so the sink
still accumulates metadata into the deferred DirTimeList but creates nothing. Empty
source dirs stay untransferred (-a), -m/--prune-empty-dirs semantics are preserved,
and a pre-existing regular file/symlink at an empty-dir mirror path no longer aborts
the transfer. dir_time_list_apply fstatat()s the leaf (AT_SYMLINK_NOFOLLOW) and skips
absent/non-directory paths QUIETLY; only a real existing directory is stamped.
Also initialize File.dir_time_only in file_create() (uninitialised garbage otherwise).

#2 (MED): send_dir_times() chunks entries into repeated STATUS_DIR_TIMES frames of at
most MAX_MANIFEST_ENTRIES, matching the receiver's per-frame bound; the tautological
> INT_MAX check is gone.

#3 (LOW): dir_time_list_add() assigns each grown array right after its realloc (no
dangling) and advances capacity only after both succeed.

#4 (LOW): RSYNC_COMPAT.md -- STATUS_MKDIR carries metadata, dir times are transmitted
via STATUS_DIR_TIMES and applied at the end, empty dirs are still never created; -m
rationale, -O row and Wave D notes updated. Summary counts untouched.

#5 (LOW): integration tests for the three #1 scenarios (empty-dir non-creation under
-a and -a -m, collision non-abort), scanner test now covers empty-dir capture, and
test_file_restore_symlink_metadata asserts the positive apply path when supported.

PROTOCOL_VERSION stays 2.17.0; config-frame layout unchanged.

src/shared/config.h

@@ -551,9 +551,10 @@ typedef struct Config {
  * -J/--omit-link-times REAL by adding directory and symlink time preservation.
  * The config-frame LAYOUT is unchanged (the omit flags already crossed the
  * wire), but the FRAME STREAM gains a new terminal frame: after all file data
- * and the optional delete manifest, the sender transmits one STATUS_DIR_TIMES
- * frame (a count followed by (path, metadata) pairs) carrying every source
- * directory's captured times, so the receiver can apply them AFTER all of a
+ * and the optional delete manifest, the sender transmits STATUS_DIR_TIMES
+ * frame(s) (each a count followed by (path, metadata) pairs, chunked so no
+ * frame exceeds the receiver's MAX_MANIFEST_ENTRIES bound) carrying every
+ * source directory's captured times, so the receiver can apply them AFTER all of a
  * directory's children have been written (writing a child bumps the parent's
  * mtime).  Symlink entries already carry their metadata on the STATUS_SYMLINK
  * frame; the receiver now applies it (utimensat/lchown with