SECURITY UPDATE: rrsync restricted directory escape via symlinks
debian/patches/CVE-2026-53783.patch: replace the Perl rrsync with
upstream's path-pinning python3 rrsync without the 3.2.4 single-run
lock, add receiver-only --drop-D
debian/control: depend on python3 for /usr/bin/rrsync