fix(p7-privilege): harden copy-as/super gates, own dirs/specials

- fake-super owner replay honors --no-super and an active --copy-as
- copy-as/identity ownership now applied to directories and special nodes
- reject copy_as_set && !use_metadata (receiver + client --no-preserve)
- daemon refuses --copy-as; add server-side --no-super operator veto
- implement identity_copy_as_refused/identity_copy_as_active
- reject copy-as ids that overflow int32; escape spec in log errors
- copy-as chown EPERM/EACCES logged at ERROR (still non-fatal)
- identity_wire_valid copy-as bounds; CLI help and RSYNC_COMPAT docs
- add unit tests and root-gated integration coverage

src/shared/xattr.c

@@ -1,5 +1,6 @@
 #define _GNU_SOURCE
 #include "xattr.h"
+#include "identity.h"
 #include "log.h"
 #include "protocol.h"
 #include "utils.h"
@@ -337,7 +338,16 @@ void fake_super_store_fd(int fd, uint32_t uid, uint32_t gid, uint32_t mode, int6
  * stat fd-relative.  A privileged (root) run can actually change the owner;
  * a non-root run silently skips the fchown on EPERM/EACCES (never fatal,
  * mirroring the normal metadata identity path; other errors are logged) and
- * still applies mode/mtime where permitted. */
+ * still applies mode/mtime where permitted.
+ *
+ * The OWNER leg additionally honors two policies:
+ *   - --no-super (privilege_super_permitted() false) suppresses it even for a
+ *     root receiver, exactly like the normal metadata identity path.
+ *   - an active --copy-as is AUTHORITATIVE: the identity path already forced the
+ *     target owner, so replaying the recorded source owner here would silently
+ *     override it.  The xattr record is still stored/replayed for a later
+ *     privileged restore; only the live chown is skipped.  Mode/mtime remain
+ *     applied either way so unprivileged --fake-super still works. */
 bool fake_super_restore_fd(int fd) {
   if (fd < 0)
     return false;
@@ -357,8 +367,11 @@ bool fake_super_restore_fd(int fd) {
      must not abort the transfer for that reason (FastSync identity philosophy).
      EPERM/EACCES (expected for a non-root receiver) are skipped silently; a
      genuine EINVAL (an impossible stored id) is logged so the corruption is
-     not hidden. */
-  if (fchown(fd, (uid_t)ul_uid, (gid_t)ul_gid) != 0 && errno != EPERM && errno != EACCES)
+     not hidden.  --no-super suppresses the owner leg even for root, and an
+     active --copy-as is authoritative so its forced owner must not be
+     overwritten by the recorded source owner. */
+  if (privilege_super_permitted() && !identity_copy_as_active() &&
+      fchown(fd, (uid_t)ul_uid, (gid_t)ul_gid) != 0 && errno != EPERM && errno != EACCES)
     log_message(LOG_LEVEL_WARNING, "--fake-super: could not restore owner on destination file: %s",
                 strerror(errno));
   /* Mode is applied through the same sanitization the normal metadata path