fix(client): route explicit remote dry-run targets, fail closed on stray status

--dry-run --server-host=H (or TLS / source-bind --address) silently ran the
client-side manifest even though a real run contacts the server.  Add a
client-only, never-serialized server_host_set bit (alongside the existing
server_port_set) and extend dry_run_targets_server so every explicit remote
target contacts the receiver.

Also make incremental_check return the dry-run code (4) only when the
session actually requested dry-run; a stray STATUS_DRY_RUN_TRANSFER from a
hostile/buggy peer is now a logged protocol error (STATUS_ERROR) instead of
falling through to send file data and desync.  Both normal send_single_file
callers handle rc == 4 explicitly as an abort.

src/client/client_cli.c

@@ -1106,6 +1106,11 @@ static bool cli_handle_table_option(CliParseCtx* ctx) {
         }
         config->use_metadata = true;
       }
+      /* Remember that --server-host was explicitly given (the field itself
+         defaults to 127.0.0.1, so a value check cannot distinguish it).  Used
+         by --dry-run to route an explicit remote target to the server. */
+      if (entry->offset == offsetof(Config, server_host))
+        config->server_host_set = true;
     }
   } else if (apply_table_option(config, entry, NULL) != 0) {
     ctx->exit_code = -1;