fix(p8-security): close review gaps in the ownership gate and copy-as failure propagation

- H3: a daemon module without 'client owner = yes' now also has super-user
  device activity forced off (char/block mknod, --write-devices), so a root
  daemon can no longer be made to create/write raw devices under AUTO.  The
  entries are skipped, preserving ordinary -a pushes.
- H1/H2: propagate a failed required --copy-as chown from symlink metadata
  restore and implicitly-created parent directories, so the entry (and run)
  reports failure instead of a wrong-owner success.
- Docs/help/headers updated for A2/A3 and the device clamp; startup warning
  spells out the client-owner risk.
- Tests: daemon device clamp (skipped without opt-in, created with opt-in),
  updated --super/--fake-super expectations.

src/shared/identity.c

@@ -679,8 +679,8 @@ static void identity_log_chown_failure(const char* what, uid_t uid, gid_t gid) {
    * restricted root, root-squash, or a read-only mount) the run would be
    * silently producing the WRONG ownership, so surface it at ERROR.  The
    * caller (identity_apply_ownership*) then reports the ENTRY as failed rather
-   * than as written; the receiver never claims a --copy-as success it did not
-   * achieve, but a single entry failure does not abort the whole run. */
+   * than as written, which becomes a FILE_SAVE_ERROR and fails the transfer
+   * (fail-fast) instead of reporting overall success with the wrong owner. */
   if (errno == EPERM || errno == EACCES) {
     if (identity_copy_as_active())
       log_message(LOG_LEVEL_ERROR,