receiver.c: Tighten alt-dest path resolution and partial-dir state validation

[seks99x]

This introduces a couple of architectural best-practices to harden the receiver's state machine and harmonize symlink handling across the delta-basis engine, addressing protocol edge-cases reported by Fyyre (fyyre@fyyre.net).

1. Strict State Validation for partial_dir (receiver.c)
   Added explicit validation to ensure one_inplace is only triggered when partial_dir is actually configured by the client and the FNAMECMP_PARTIAL_DIR token is legitimate. This prevents any potential protocol state confusion where a peer sending unexpected/forged tokens could bypass temp-file cleanup or misroute in-place writes.

2. Harmonized Leaf Symlink Handling (receiver.c)
   When an operator path was sent, secure_basis_open() called open_no_attacker_symlinks() for partial-dir/link-dest/fuzzy-dest path resolving, which followed leaf symlinks. Since standard operator-path behavior dictates that leaves should not be followed (consistent with standard do_*_at style, copy_file()) I've updated this logic to enforce O_NOFOLLOW on the final component and walk the parent with owner_walk_parent, bringing our path resolution into perfect alignment with standard operator-path behavior.

[steadytao]

The partial_dir state guard looks reasonable, but the leaf-opening rewrite changes established operator-path and --insecure-links behaviour without tests. Please preserve the explicit compatibility opt-out and add focused positive and negative cases before this merges. The diff also needs normal rsync indentation and comment cleanup.

[steadytao]

Mostly LGTM. Just some slight test nits.

[steadytao]

git diff --check reports ten whitespace errors and the receiver.c addition does not follow the surrounding C style. Test 2 also still lacks an ordinary non-forged control and does not assert the receiver process result so an unrelated verification failure can satisfy the negative oracle.