feat(p7-times): real directory/symlink time preservation; -O/-J meaningful

Wave D of Phase 7. Make -O/--omit-dir-times and -J/--omit-link-times real by
preserving directory and symlink times, and mark --secluded-args as an explicit
Impossible/Divergence no-op.

Wire: PROTOCOL_VERSION 2.16.0 -> 2.17.0. Adds a terminal STATUS_DIR_TIMES frame
(int count + (wire path, metadata) pairs) sent after all file data and the
optional delete manifest. STATUS_MKDIR also carries metadata for --dirs entries.
Config-frame layout is unchanged.

Sender: the recursive scanner captures every traversed source directory (both
DirectoryScanner and the parallel scanner root + workers, appends mutex-guarded)
into a shared list; the single-threaded and -m paths transmit it last.

Receiver: a DirTimeList accumulates received directory metadata and applies it
with fd-relative no-follow utimensat only at the very end -- after all children,
after the commit-style --delete, and after --delay-updates publication -- in the
single-threaded success frame and in server.c after the -m threads join. -O skips
the application. Symlink metadata is applied at link creation with
utimensat/fchownat/fchmodat AT_SYMLINK_NOFOLLOW; -J suppresses only link times.
identity_apply_ownership_link shares the identity resolver with the fd path.

Docs: -O/-J rows -> Implemented; --secluded-args -> Impossible/Divergence;
--protocol accepted/rejected values and Phase-6/7 notes updated.

Tests: unit (scanner dir capture, DirTimeList apply, symlink metadata, protocol
version values) and integration (dir mtime round-trip + -O, symlink mtime
round-trip + -J, independent suppression), parameterized over single/multithread.

src/client/scanner.h

@@ -98,6 +98,18 @@ typedef struct {
    * (without marking the scan as failed), so a busy scan itself stops early.
    * Client-only, never serialized to the wire. */
   const StopCondition* stop_condition;
+  /* P7 Wave D (protocol 2.17.0): directory-time capture sink.  When
+   * `capture_dir_times` is true the recursive scan appends one is_dir File
+   * (with metadata, no payload) per source directory it traverses to
+   * `dir_entries`, so the sender can transmit a single trailing
+   * STATUS_DIR_TIMES frame and the receiver can apply directory mtimes AFTER
+   * all children are written.  `dir_entries_mutex` (optional) guards the list
+   * for the parallel scanner's shared worker threads; the caller owns both.
+   * The --dirs generator does not use this (its directory entries carry their
+   * metadata inline through STATUS_MKDIR). */
+  bool capture_dir_times;
+  ArrayList* dir_entries;
+  mtx_t* dir_entries_mutex;
 } ScannerOptions;
 
 /* Internal per-scanner filter state. FilterNode chains represent the ordered
@@ -173,6 +185,10 @@ typedef struct {
   HardLinkTable* hardlinks;
   /* Phase 6: sender stop deadline (from ScannerOptions). */
   const StopCondition* stop_condition;
+  /* P7 Wave D directory-time capture (see ScannerOptions). */
+  bool capture_dir_times;
+  ArrayList* dir_entries;
+  mtx_t* dir_entries_mutex;
 } DirectoryScanner;
 
 typedef struct {