* SECURITY UPDATE: --delete scope expansion by a malicious sender - debian/patches/CVE-2026-53789.patch: downgrade implied-parent directories to FLAG_IMPLIED_DIR on the receiver, covering synthetic and legacy implied parents, so a sender cannot mark a parent as a content dir and have delete_in_dir() sweep pre-existing siblings. The parse_filter_file() module-dir strip that upstream bundled into the same commit is not taken here: it is the CVE-2026-53786 fix per upstream NEWS and ships in debian/patches/CVE-2026-53786.patch - the patch's two regression tests are rewritten against this tree's shell testsuite, as upstream's pytest-based ones need a harness 3.2.3 does not have; debian/control gains python3 in Build-Depends for them - CVE-2026-53789