feat: receiver-side basis matching with link/copy materialization

The receiver's per-file incremental check now consults the ordered basis-dir
list whenever the destination is not already up to date.  An exact basis match
requires equal size, equal mtime (unless --size-only; --ignore-times disables
basis matching like rsync), and an equal content xxHash64 -- the sender sends
its xxHash for every file whenever basis dirs are configured (not only under
--checksum), so a hard link or local copy is only ever made from byte-identical
content.

On a match:
  - compare-dest: reply STATUS_OK and skip data only when the destination does
    not already hold the file (sparse, rsync parity).  A destination that holds
    a DIFFERENT version falls back to a normal transfer instead of rsync's
    delete, keeping the mirror complete.
  - copy-dest: reply STATUS_OK and hand a synthetic File (bytes read from the
    basis file, basis metadata) to the normal store sink, so the file is
    installed as a real local copy through the existing atomic temp+rename
    engine and honors --existing/--ignore-existing/--update/--backup/
    --delay-updates/--partial-dir unchanged.
  - link-dest: same, but File.basis_link records the basis path and the store
    engine calls the new file_to_disk_secure_link(): an atomic temp hard link +
    rename.  Cross-filesystem/refused links fall back to a byte-identical local
    copy (never a corrupt or partial file); the copy fallback applies metadata,
    while a successful link keeps the basis inode's own attributes so the basis
    file is never mutated.

Basis-materialized files carry File.skip so they are not acknowledged to a
--remove-source-files sender (the sender already saw STATUS_OK and keeps the
source).  The no-match path is byte-for-byte identical to the existing delta /
full-data transfer.

src/shared/file.h

@@ -63,5 +63,12 @@ bool file_to_disk_secure_no_replace(const char* path, const void* data,
                                     unsigned long long data_size, bool sparse,
                                     const FileMetadata* metadata, bool preserve_executability,
                                     const char* temp_dir);
+/* Atomic --link-dest install: replace `path` with a hard link to `basis_path`
+   (via a temp name + rename); fall back to a byte-identical local copy from
+   `data` when the link is impossible (EXDEV/EPERM/unsupported filesystem).
+   `metadata` is applied only on the copy fallback. */
+bool file_to_disk_secure_link(const char* path, const char* basis_path, const void* data,
+                              unsigned long long data_size, const FileMetadata* metadata,
+                              bool preserve_executability, bool use_fsync, const char* temp_dir);
 
 #endif