fix(receiver): non-blocking receiver opens, inplace type gate, dry-run/B4/B5/B6

Address confirmed receiver security findings B1-B6:

B1 (HIGH): add O_NONBLOCK to the three receiver read-opens that opened an
existing destination/basis entry before the S_ISREG gate
(incremental_check_open_destination, basis_open_regular, hardlink_read_source)
so a client-planted FIFO can no longer block the receive thread forever while
the post-open type gate still rejects it.

B2 (HIGH/MED): --inplace now fstatat(AT_SYMLINK_NOFOLLOW)-probes the target and
refuses any existing non-regular entry, opens with O_NONBLOCK, and re-checks
S_ISREG on the opened fd.  This stops a FIFO from hanging the open and stops a
char/block device from being written directly (bypassing --write-devices).

B3 (MED): under --dry-run the incremental quick-skip no longer reads/hashes the
destination file for --checksum/--delta; it decides from metadata only and
reports would-transfer when the comparison is inconclusive, closing the
read-only-module content-hash oracle.

B4 (LOW): xattr_name_appliable() now gates the two system.posix_acl_* names on
preserve_acls (--acls), not the derived use_xattrs (--xattrs OR --acls).  The
receiver drops (never applies) ACL entries when -A was not negotiated while
keeping user.* working for -X.

B5 (INFO): receive_manifest_section() charges a per-entry overhead against
MAX_MANIFEST_BYTES and the aggregate entry count across all three sections is
capped at MAX_MANIFEST_ENTRIES.

B6 (MED): data_charge_session() reserves decompressed/chunk-copy bytes against
the owning ProtocolSession (MAX_CONNECTION_MEMORY) and records them on the Data
so data_destroy() releases them via the Data.owner path.  Applied to the
whole-file/append/delta decompression sites and chunk_deserialize() per-file
copies; a missing session owner degrades to the previous uncharged behavior.

Tests: FIFO destination/basis non-hang (with alarm), --inplace FIFO/device
refusal, dry-run no-read oracle test plus updated metadata-only dry-run tests,
ACL-without--acls drop, manifest total-entry cap, and chunk session charging.

src/shared/chunk.c

@@ -1,6 +1,7 @@
 #include <stddef.h>
 #include <stdint.h>
 #include <limits.h>
+#include <stdatomic.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -20,6 +21,33 @@
 #define MAX_FILE_DATA_SIZE (64ULL * 1024 * 1024)
 #define MAX_FILES_PER_CHUNK 65536U
 
+/* Reserve `charge` against `session`'s connection budget.  This mirrors the
+   static protocol_reserve_memory() in protocol.c: the receive-side call sites
+   only have the Data.owner pointer (a ProtocolSession*), and protocol.c is out
+   of scope for this fix, so the same atomic CAS accounting is reproduced here.
+   The matching release always goes through data_destroy()'s Data.owner path. */
+static bool chunk_session_reserve(ProtocolSession* session, size_t charge) {
+  unsigned long long allocated = atomic_load(&session->total_allocated_bytes);
+  while (true) {
+    if (allocated > MAX_CONNECTION_MEMORY ||
+        (unsigned long long)charge > MAX_CONNECTION_MEMORY - allocated)
+      return false;
+    if (atomic_compare_exchange_weak(&session->total_allocated_bytes, &allocated,
+                                     allocated + (unsigned long long)charge))
+      return true;
+  }
+}
+
+bool data_charge_session(Data* data, ProtocolSession* session, size_t charge) {
+  if (!data || charge == 0 || session == NULL)
+    return true;
+  if (!chunk_session_reserve(session, charge))
+    return false;
+  data->owner = session;
+  data->protocol_charge = charge;
+  return true;
+}
+
 Chunk* chunk_create(File** items, int element_count) {
   if (element_count < 0 || (element_count > 0 && items == NULL))
     return NULL;
@@ -370,6 +398,15 @@ Chunk* chunk_deserialize(Data* data, bool use_metadata) {
     Data* replacement = data_create(file_data, file_data_size);
     if (replacement == NULL)
       goto error;
+    /* Charge the retained per-file copy to the connection budget (when the
+       inbound chunk carries an owning session) so the queued copies are not
+       held outside MAX_CONNECTION_MEMORY (B6).  A NULL owner (e.g. a local
+       batch apply) leaves the copy uncharged. */
+    if (!data_charge_session(replacement, data->owner, allocation_size)) {
+      log_message(LOG_LEVEL_ERROR, "Per-connection memory limit exceeded for chunk file data");
+      data_destroy(replacement);
+      goto error;
+    }
     data_destroy(file->data);
     file->data = replacement;
     data_pointer += file_data_size;
@@ -466,12 +503,21 @@ Chunk* receive_chunk_data(int fd, const Config* config) {
   }
   Data* data_to_process = chunk_data;
   if (config->use_compression) {
+    /* Preserve the inbound session across decompression so the (larger)
+       decompressed chunk is charged to the same connection budget; the
+       compressed buffer's own charge is released by data_destroy below. */
+    ProtocolSession* owner = chunk_data->owner;
     data_to_process = data_decompress_limited(chunk_data, MAX_CHUNK_SIZE);
     data_destroy(chunk_data);
     if (data_to_process == NULL) {
       log_message(LOG_LEVEL_ERROR, "Failed to decompress chunk");
       return NULL;
     }
+    if (!data_charge_session(data_to_process, owner, data_to_process->size)) {
+      log_message(LOG_LEVEL_ERROR, "Per-connection memory limit exceeded for decompressed chunk");
+      data_destroy(data_to_process);
+      return NULL;
+    }
   }
 
   // Reject chunks larger than the maximum allowed size to prevent OOM.