feat(shared): --delete-missing-args config/wire, manifest third section, receiver exact-path deletions

PROTOCOL_VERSION 2.9.0 -> 2.10.0. The STATUS_MANIFEST frame gains a third
section carrying destination-relative exact-delete paths (the missing
--files-from entries' mirrors); the config frame gains a delete_missing_args
bool (ignore_missing_args stays client-only). The receiver validates the third
section like the keep-set and commits it with manifest_delete_all():
manifest_delete_missing_args runs first (explicit user requests, never blocked
by protected-prefix exclusion protection; staging/basis protected; a non-empty
directory mirror removed only under --force/--delete, rsync parity) and then the
ordinary extras walk. Server --allow-delete gates it like --delete.

src/shared/utils.h

@@ -32,6 +32,11 @@ typedef struct {
   const char* prefix;
   bool top_level_only;
 } DeleteSkipEntry;
+/* True when child_rel is, or lies below, one of the protected entries (a prefix
+   "a" protects "a" and "a/b/c" but not "ab"; top_level_only entries protect
+   only DIRECT children of the destination root, i.e. child_rel has no '/'). */
+bool path_under_skip_prefix(const char* child_rel, bool at_root, const DeleteSkipEntry* skips,
+                            int skip_count);
 /* Remove files/dirs under dest_root that are not listed in manifest without
    ever descending into a protected prefix (see DeleteSkipEntry).  When
    max_delete is not SIZE_MAX the run is all-or-nothing: extras are counted