fix(p7-privilege): harden copy-as/super gates, own dirs/specials

- fake-super owner replay honors --no-super and an active --copy-as
- copy-as/identity ownership now applied to directories and special nodes
- reject copy_as_set && !use_metadata (receiver + client --no-preserve)
- daemon refuses --copy-as; add server-side --no-super operator veto
- implement identity_copy_as_refused/identity_copy_as_active
- reject copy-as ids that overflow int32; escape spec in log errors
- copy-as chown EPERM/EACCES logged at ERROR (still non-fatal)
- identity_wire_valid copy-as bounds; CLI help and RSYNC_COMPAT docs
- add unit tests and root-gated integration coverage

src/client/client_validation.c

@@ -170,5 +170,15 @@ bool validate_config(const Config* config) {
                 PROTOCOL_VERSION);
     return false;
   }
+  /* --copy-as pushes the source ids through the metadata path (it implies
+     --preserve).  A later --no-preserve would clear use_metadata, leaving the
+     transfer with nothing to chown while the receiver gate would still pass.
+     Refuse the combination up front rather than silently chowning nothing. */
+  if (config->copy_as_set && !config->use_metadata) {
+    log_message(LOG_LEVEL_ERROR,
+                "--copy-as requires metadata preservation and cannot be combined with "
+                "--no-preserve");
+    return false;
+  }
   return true;
 }