feat: implement -R/--relative, --no-implied-dirs, --dirs/-d, --mkpath

RSYNC_COMPAT Phase-2 row M: path-list construction and destination
directory creation while preserving traversal safety.

- -R/--relative with --files-from: transmit each listed entry under its
  bare relative destination path (no source-root mirror). Files keep an
  absolute local read path plus a separate wire/dest path (File.send_path);
  manifest, incremental quick-check and change output follow the wire path,
  so --delete and --remove-source-files stay consistent. -R without
  --files-from is unchanged (full mirror).
- --no-implied-dirs: client-only, only meaningful with -R + --files-from.
  A listed file whose parent dir is not itself (or via an ancestor)
  explicitly listed cannot be placed; the run fails up front with a clear
  error. No effect otherwise.
- --dirs/-d + --old-dirs/--old-d aliases: -d <dir> transmits the source
  root as an explicit empty directory entry (STATUS_MKDIR frame); with
  --files-from listed dirs are created empty and listed files transferred,
  never descending. Works single-threaded, -m (sequential scanner in the
  -m scan thread) and chunk-serialization (per-file type marker).
  Directory entries appear in the delete manifest.
- --mkpath: new wire bool; server creates the destination root (and missing
  leading components under its authorized root) at connection start. A
  missing destination root is now rejected by default.
- Protocol bumped to 2.7.0 (mkpath wire field + STATUS_MKDIR + chunk type
  marker). All receive paths funnel through file_save_to_disk_full which
  creates directories via the secure confined mkdir engine; dir entries are
  excluded from --remove-source-files outcome acknowledgements on both ends.
- Unit coverage: CLI parse (relative/dirs aliases/mkpath/no-implied-dirs),
  config round-trip (relative + mkpath), scanner --dirs non-recursion and
  -R send_path (sequential + parallel), receiver dir-entry save.
- Integration coverage: TestRelativeFilesFrom, TestNoImpliedDirs, TestDirs,
  TestMkpath (single and -m).
- RSYNC_COMPAT: 4 rows move to Implemented (Summary 67/3/5/1/71 = 147).

src/server/receiver.c

@@ -133,7 +133,8 @@ int receiver_process(Config* config, int file_descriptor, const ReceiverSink* si
   if (!receive_status(file_descriptor, &status))
     return -1;
   while (status == STATUS_NEXT || status == STATUS_CHUNK || status == STATUS_CHECK ||
-         status == STATUS_KEEPALIVE || status == STATUS_ABORT || status == STATUS_CHECK_BATCH) {
+         status == STATUS_KEEPALIVE || status == STATUS_ABORT || status == STATUS_CHECK_BATCH ||
+         status == STATUS_MKDIR) {
     if (status == STATUS_KEEPALIVE) {
       if (!send_status(file_descriptor, STATUS_KEEPALIVE))
         return -1;
@@ -156,6 +157,10 @@ int receiver_process(Config* config, int file_descriptor, const ReceiverSink* si
       if (!receiver_process_batch(config, file_descriptor))
         return -1;
       goto next;
+    } else if (status == STATUS_MKDIR) {
+      File* dir = file_receive_directory(file_descriptor);
+      if (!dir || !sink->store_file(dir, sink->context))
+        goto receive_error;
     } else {
       File* file = file_receive(config, file_descriptor);
       if (!file) {
@@ -208,7 +213,7 @@ static bool receiver_save_file(File* file, void* context_pointer) {
   } else {
     result = file_save_to_disk_full(context->config->receive_root_directory, file, context->config);
   }
-  if (result != FILE_SAVE_ERROR && context->config->remove_source_files &&
+  if (result != FILE_SAVE_ERROR && context->config->remove_source_files && !file->is_dir &&
       !receiver_outcomes_append(&context->outcomes, (unsigned char)result)) {
     file_destroy(file);
     return false;

src/server/server.c

@@ -63,6 +63,21 @@ static bool path_is_within(const char* root, const char* path) {
   return strncmp(root, path, n) == 0 && (path[n] == '\0' || path[n] == '/');
 }
 
+/* --mkpath contract: when the client's destination root directory does not
+   exist yet on the server side, --mkpath tells the server to create it (and
+   any missing leading components) below the authorized root at connection
+   start.  Without --mkpath the destination root must already exist: a missing
+   root is rejected up front instead of being silently invented by a later
+   write.  Both paths are confined to the authorized root by the secure file
+   helpers. */
+static bool ensure_receive_root(const Config* config) {
+  if (!config || !config->receive_root_directory)
+    return false;
+  if (config->mkpath)
+    return file_ensure_directory_secure(config->receive_root_directory);
+  return file_directory_exists_secure(config->receive_root_directory);
+}
+
 static bool __attribute__((unused)) configure_authorization(const char* root) {
   char resolved[PATH_MAX];
   if (!root) {
@@ -165,6 +180,17 @@ void handler(int file_descriptor) {
     return;
   }
   config->use_delete = config->use_delete && allow_delete;
+  /* --mkpath: create the destination root (and its missing leading components)
+     before anything else; without it the root must pre-exist.  A failure here
+     aborts the connection cleanly before any file data is exchanged. */
+  if (!ensure_receive_root(config)) {
+    log_message(LOG_LEVEL_ERROR, "destination root is not available: %s",
+                config->receive_root_directory);
+    config_delete(config);
+    close(file_descriptor);
+    protocol_session_unbind();
+    return;
+  }
   /* A --delay-updates transfer stages under a private 0700 directory inside
      the receive root.  Create it up front (wiping leftovers of any previously
      interrupted delayed transfer) so a fully-skipped run also starts clean. */