fix(p8-security): close review gaps in the ownership gate and copy-as failure propagation

- H3: a daemon module without 'client owner = yes' now also has super-user
  device activity forced off (char/block mknod, --write-devices), so a root
  daemon can no longer be made to create/write raw devices under AUTO.  The
  entries are skipped, preserving ordinary -a pushes.
- H1/H2: propagate a failed required --copy-as chown from symlink metadata
  restore and implicitly-created parent directories, so the entry (and run)
  reports failure instead of a wrong-owner success.
- Docs/help/headers updated for A2/A3 and the device clamp; startup warning
  spells out the client-owner risk.
- Tests: daemon device clamp (skipped without opt-in, created with opt-in),
  updated --super/--fake-super expectations.

src/shared/identity.h

@@ -7,7 +7,7 @@
 #include <sys/types.h>
 
 /*
- * Identity mapping: --numeric-ids / --usermap / --groupmap / --chown.
+ * Identity mapping: --numeric-ids / --usermap / --groupmap / --chown / --copy-as.
  *
  * FastSync transmits uid/gid numerically (int32 on the wire) and, by design,
  * NEVER applies client-supplied ownership unless a user explicitly opts in with
@@ -87,9 +87,10 @@ bool identity_ownership_requested(const Config* config);
 
 /* Apply the negotiated ownership to an already-written file descriptor.
  * source_uid/source_gid are the transmitted numeric ids.  Resolution order:
- * a matching usermap/groupmap rule, then --chown, then --numeric-ids (raw),
- * then a best-effort name lookup on the receiver's own databases (skipped when
- * the transmitted id has no name on this system).  Only calls fchown() when the
+ * --copy-as (highest priority, forces both ids), then a matching
+ * usermap/groupmap rule, then --chown, then --numeric-ids (raw), then a
+ * best-effort name lookup on the receiver's own databases (skipped when the
+ * transmitted id has no name on this system).  Only calls fchown() when the
  * result differs from the current value.
  *
  * Returns false ONLY when an active --copy-as ownership application failed: its