fix(p7-times): dir-time entries only record (never create dirs); bound/chunk dir-time frames; harden list add; docs+tests

Review fixes for Phase 7 Wave D.

#1 (HIGH): STATUS_DIR_TIMES entries no longer create directories. A new
receiver-only File.dir_time_only flag marks dir-time entries; file_save_to_disk_full
short-circuits them as FILE_SAVE_SKIPPED before any device/dir branch, so the sink
still accumulates metadata into the deferred DirTimeList but creates nothing. Empty
source dirs stay untransferred (-a), -m/--prune-empty-dirs semantics are preserved,
and a pre-existing regular file/symlink at an empty-dir mirror path no longer aborts
the transfer. dir_time_list_apply fstatat()s the leaf (AT_SYMLINK_NOFOLLOW) and skips
absent/non-directory paths QUIETLY; only a real existing directory is stamped.
Also initialize File.dir_time_only in file_create() (uninitialised garbage otherwise).

#2 (MED): send_dir_times() chunks entries into repeated STATUS_DIR_TIMES frames of at
most MAX_MANIFEST_ENTRIES, matching the receiver's per-frame bound; the tautological
> INT_MAX check is gone.

#3 (LOW): dir_time_list_add() assigns each grown array right after its realloc (no
dangling) and advances capacity only after both succeed.

#4 (LOW): RSYNC_COMPAT.md -- STATUS_MKDIR carries metadata, dir times are transmitted
via STATUS_DIR_TIMES and applied at the end, empty dirs are still never created; -m
rationale, -O row and Wave D notes updated. Summary counts untouched.

#5 (LOW): integration tests for the three #1 scenarios (empty-dir non-creation under
-a and -a -m, collision non-abort), scanner test now covers empty-dir capture, and
test_file_restore_symlink_metadata asserts the positive apply path when supported.

PROTOCOL_VERSION stays 2.17.0; config-frame layout unchanged.

tests/test_metadata.c

@@ -303,9 +303,11 @@ static void test_chmod_changes() {
 }
 
 /* P7 Wave D: symlink metadata is applied with no-follow primitives, and -J
- * (omit_link_times) suppresses the timestamp.  The test is robust to
- * filesystems that silently ignore symlink timestamps: it mainly proves the
- * omit path never touches the stored time. */
+ * (omit_link_times) suppresses the timestamp.  The positive apply path is
+ * asserted when the filesystem actually stores symlink timestamps; a filesystem
+ * that silently ignores them (or a platform where utimensat AT_SYMLINK_NOFOLLOW
+ * is unsupported) is tolerated, in which case only the omit-path invariant is
+ * checked. */
 static void test_file_restore_symlink_metadata() {
   const char* dir = "temp_symlink_md_test";
   const char* target = "temp_symlink_md_test/target";
@@ -317,11 +319,13 @@ static void test_file_restore_symlink_metadata() {
   fclose(f);
   EXPECT_EQ_INT(symlink("target", link), 0);
 
+  /* Positive path: a non-omitted apply stamps the link's own mtime. */
   FileMetadata applied = {.mtime_sec = 1000000000, .mtime_nsec = 0};
   file_restore_symlink_metadata(link, &applied, false);
   struct stat st;
   EXPECT_EQ_INT(lstat(link, &st), 0);
   EXPECT_TRUE(S_ISLNK(st.st_mode));
+  bool symlink_times_supported = ((int)st.st_mtime == 1000000000);
   time_t t1 = st.st_mtime;
 
   /* -J: a different time must be left untouched. */
@@ -329,6 +333,8 @@ static void test_file_restore_symlink_metadata() {
   file_restore_symlink_metadata(link, &newer, true);
   EXPECT_EQ_INT(lstat(link, &st), 0);
   EXPECT_EQ_INT((int)st.st_mtime, (int)t1);
+  if (symlink_times_supported)
+    EXPECT_EQ_INT((int)st.st_mtime, 1000000000);
 
   unlink(link);
   unlink(target);