mv: create the cross-device destination exclusively and chown it by fd

[krosci]

rename_file_fallback kept the destination descriptor across the copy but preserve_ownership re-resolved the destination by path and called lchown, so a concurrent path-swap could redirect the chown to another inode. The comment above the block claimed a guarantee the code did not provide.

The cross-device leaf now chowns through the descriptor it already holds with fchown, and the destination is created with O_EXCL, matching GNU. create_dest_restrictive gains an exclusive flag, while cp keeps truncating a pre-existing destination.

Fixes #14599.

[github-actions]

GNU testsuite comparison:

Skipping an intermittent issue tests/date/resolution (passes in this run but fails in the 'main' branch)

[krosci]

@sylvestre could you take a look at it? Thanks!

[codspeed]

Merging this PR will regress 1 benchmark

⚡ 1 improved benchmark
❌ 1 regressed benchmark
✅ 387 untouched benchmarks
⏩ 54 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Simulation	five_38_bit_primes	1.8 s	2.1 s	-11.52%
⚡	Simulation	three_39_bit_primes	467.5 ms	145.6 ms	×3.2

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing krosci:mv-fchown-cross-device (53a7ac7) with main (a6d1eb3)}

Footnotes

1. 54 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩