fix(backup): carry extended attributes, ACLs and hardlinks into a generation

rsync -a expands to -rlptgoD, so the backup stored neither extended
attributes nor ACLs nor hardlinks while the restore side asks for
-aHAX. A generation therefore never held what a restore wants back, and
rsync faithfully mirrored a snapshot that has none.

Reproduced end to end against a source carrying user.oc.* attributes and
a hardlink: with the old argv, getfattr -d -R over the generation returns
nothing and the hardlink splits into two inodes; with -aHAX both sides
come back identical to the source. That is the shape in which an
OpenCloud volume survived a disaster-recovery drill with its files intact
and its storage metadata gone, so its posix driver skipped every space it
could no longer read.

restore/files.py had the same gap on this repository's own restore path.

Two consequences worth knowing. The first backup after this re-copies
every attribute-carrying volume once, because rsync declines to hardlink
against a generation whose xattrs do not match. And a backup destination
on a filesystem without xattr support now fails the run instead of
producing a generation that cannot be restored.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/unit/backup/test_volume.py

@@ -46,9 +46,12 @@ class TestBackupVolume(unittest.TestCase):
     def test_it_carries_no_kernel_objects_into_a_generation(self) -> None:
         self.assertIn("--no-D", self.copy())
 
+    def test_it_stores_the_metadata_a_restore_has_to_give_back(self) -> None:
+        self.assertIn("-aHAX", self.copy())
+
     def test_it_keeps_no_twin_of_what_the_second_pass_replaces(self) -> None:
         command = self.copy(authoritative=True)
-        self.assertEqual(command[:2], ["rsync", "-aP"])
+        self.assertEqual(command[:3], ["rsync", "-aHAX", "-P"])
         self.assertNotIn("--backup", command)
 
     def test_it_creates_the_destination(self) -> None: