feat: implement --delay-updates receiver staging and publication

Stage every successfully written file under a private 0700 .fastsync-stage
directory inside the receive root and atomically publish all staged files
only after the whole protocol stream (manifest/delete handling included)
has completed, immediately before the success/outcome frame.  On any
abort/error before publication nothing is installed and staging is removed;
a publish failure aborts the transfer with best-effort cleanup of the
remainder (already-published files are not rolled back).  Crash leftovers
are wiped when the next delayed transfer starts.

Wire: new delay_updates config flag (selection-options block), protocol
version bumped to 2.6.0, client/server validation rejects --inplace.
CLI/usage/validation updated.  Works in single-threaded and -m modes
(exactly one write_thread stages files; the staged-file registry is
mutex-protected; publication runs once after both threads join).
--existing/--ignore-existing/--update decide against the final destination
at stage time; --backup is deferred to publication.  remove_source_files
outcomes are only sent after publication so skipped/unpublished sources are
never deleted.  Default (no flag) behavior is unchanged.

Tests: config wire round-trip, CLI parse, --inplace rejection, new
test_delay_updates unit suite (27 suites total), and integration
TestDelayUpdates covering single/-m parity, incremental reruns, remove
source files, receiver-skip ordering, and a deterministic publish-failure
abort path.

src/shared/delay_updates.h

@@ -0,0 +1,62 @@
+#ifndef DELAY_UPDATES_H
+#define DELAY_UPDATES_H
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <threads.h>
+
+/* Forward-declared in config.h; full type needed by file_save_to_disk. */
+typedef struct Config Config;
+
+/* One staged file awaiting publication. */
+typedef struct {
+  char* staged_path; /* full path inside the staging tree */
+  char* final_path;  /* full final destination path */
+  char* file_path;   /* the file path as received on the wire */
+} StagedFileEntry;
+
+/* Receiver-side --delay-updates staging registry.  All successfully written
+   files land under a private staging directory inside the receive root and are
+   atomically renamed into their final destination only at the very end of the
+   transfer.  A single PipelineContextReceiver has exactly one writer thread,
+   but the registry is still mutex-protected so the same object can be safely
+   shared with the publish/cleanup phase that runs after the threads join. */
+typedef struct DelayUpdatesContext {
+  char* root_directory; /* receive root the staging dir lives under */
+  char* staging_root;   /* root_directory/<staging dir name> */
+  mtx_t mutex;
+  StagedFileEntry* entries;
+  size_t count;
+  size_t capacity;
+  bool prepared; /* staging dir created and stale leftovers wiped once */
+} DelayUpdatesContext;
+
+/* Name of the private staging subdirectory created under the receive root. */
+#define DELAY_UPDATES_STAGING_DIR ".fastsync-stage"
+
+/* Create an empty staging context rooted below root_directory.  Does not touch
+   the filesystem yet. */
+DelayUpdatesContext* delay_updates_context_create(const char* root_directory);
+void delay_updates_context_destroy(DelayUpdatesContext* context);
+
+/* Create the private 0700 staging directory (on first call) and wipe any
+   leftovers from a previously interrupted delayed transfer.  Idempotent. */
+bool delay_updates_prepare(DelayUpdatesContext* context);
+
+/* Record a fully-written staged file for later publication.  Copies all three
+   paths.  Returns false on allocation failure. */
+bool delay_updates_record(DelayUpdatesContext* context, const char* staged_path,
+                          const char* final_path, const char* file_path);
+
+/* Atomically rename every staged file into its final destination.  Deferred
+   --backup handling runs immediately before each rename.  On any failure the
+   remaining staged files are removed (best effort); already-published files
+   are not rolled back.  Afterwards the staging tree is removed so a successful
+   or failed publish leaves no staging leftovers. */
+bool delay_updates_publish(DelayUpdatesContext* context, const Config* config);
+
+/* Best-effort removal of every staged file and the staging directory itself.
+   Safe to call when nothing was staged or after a successful publish. */
+void delay_updates_cleanup(DelayUpdatesContext* context);
+
+#endif