fix(p8-security): close review gaps in the ownership gate and copy-as failure propagation

- H3: a daemon module without 'client owner = yes' now also has super-user
  device activity forced off (char/block mknod, --write-devices), so a root
  daemon can no longer be made to create/write raw devices under AUTO.  The
  entries are skipped, preserving ordinary -a pushes.
- H1/H2: propagate a failed required --copy-as chown from symlink metadata
  restore and implicitly-created parent directories, so the entry (and run)
  reports failure instead of a wrong-owner success.
- Docs/help/headers updated for A2/A3 and the device clamp; startup warning
  spells out the client-owner risk.
- Tests: daemon device clamp (skipped without opt-in, created with opt-in),
  updated --super/--fake-super expectations.

src/shared/metadata.h

@@ -44,8 +44,10 @@ bool file_restore_metadata_fd(int fd, const FileMetadata* metadata, bool preserv
  * under the authorized root.  `omit_link_times` (-J/--omit-link-times)
  * suppresses the timestamps; the link's mode/ownership are still attempted
  * (ownership stays gated by the identity policy and by default is not applied).
- * A null metadata or an unfollowable parent is a harmless no-op. */
-void file_restore_symlink_metadata(const char* path, const FileMetadata* metadata,
+ * A null metadata or an unfollowable parent is a harmless no-op.  Returns false
+ * only when a REQUIRED --copy-as ownership application failed, so the caller can
+ * report the entry as failed instead of claiming a wrong-owner success. */
+bool file_restore_symlink_metadata(const char* path, const FileMetadata* metadata,
                                    bool omit_link_times);
 
 /* Compare timestamps using rsync's whole-second modification window. */