fix(p7-output-fs): address c-review (fake-super mode sanitization HIGH; sparse/preallocate precedence; partial no_replace guard; stronger tests)

- fake_super_restore_fd now sanitizes mode like metadata_mode (never grants
  S_IWGRP|S_IWOTH; 0666 -> 0644), fixing a privilege regression
- --sparse takes precedence over --preallocate (skip posix_fallocate when
  sparse) so holes are not re-allocated; docs corrected
- --partial retention disabled under --no_replace (ignore/existing) and only
  marks write_attempted after the write begins (no empty-temp retention)
- accept --block-size=SIZE / --delta-block=SIZE inline forms; neutral messages
- fake-super EPERM/EACCES skipped silently (docs aligned); EINVAL still logged
- sparse unit test now memcmp's the full buffer; TestBlockSize integration keeps
  the destination basis so delta is genuinely exercised
- unit 37/37, cppcheck 0, clang-format 0

src/shared/xattr.h

@@ -89,9 +89,11 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
 /* --fake-super replay: parse the FAKESUPER_XATTR record previously written on
  * `fd` by fake_super_store_fd and re-apply uid/gid/mode/mtime fd-relative.
  * Best-effort: absence of the xattr or a malformed record is a silent no-op
- * that never fails the transfer, and fchown is applied only when permitted
- * (a non-root EPERM is logged and skipped, matching FastSync's identity
- * philosophy).  Returns true when the xattr was present and parsed. */
+ * that never fails the transfer; fchown is applied only when permitted (a
+ * non-root EPERM/EACCES is skipped silently, matching FastSync's identity
+ * philosophy), and the mode is sanitized exactly like the normal metadata path
+ * (group/other write bits never granted).  Returns true when the xattr was
+ * present and parsed. */
 bool fake_super_restore_fd(int fd);
 
 #endif