mv: create the cross-device destination exclusively and chown it by fd

[krosci]

rename_file_fallback kept the destination descriptor across the copy but preserve_ownership re-resolved the destination by path and called lchown, so a concurrent path-swap could redirect the chown to another inode. The comment above the block claimed a guarantee the code did not provide.

The cross-device leaf now chowns through the descriptor it already holds with fchown, and the destination is created with O_EXCL, matching GNU. create_dest_restrictive gains an exclusive flag, while cp keeps truncating a pre-existing destination.

Fixes #14599.

[github-actions]

GNU testsuite comparison:

Skip an intermittent issue tests/date/date-locale-hour (fails in this run but passes in the 'main' branch)
Skipping an intermittent issue tests/tail/retry (passes in this run but fails in the 'main' branch)
Note: The gnu test tests/seq/seq-epipe is now being skipped but was previously passing.

[krosci]

@sylvestre could you take a look at it? Thanks!