mv: create the cross-device destination exclusively and chown it by fd

[krosci]

rename_file_fallback kept the destination descriptor across the copy but preserve_ownership re-resolved the destination by path and called lchown, so a concurrent path-swap could redirect the chown to another inode. The comment above the block claimed a guarantee the code did not provide.

The cross-device leaf now chowns through the descriptor it already holds with fchown, and the destination is created with O_EXCL, matching GNU. create_dest_restrictive gains an exclusive flag, while cp keeps truncating a pre-existing destination.

Fixes #14599.

[github-actions]

GNU testsuite comparison:

Skip an intermittent issue tests/tail/retry (fails in this run but passes in the 'main' branch)
Skipping an intermittent issue tests/cut/bounded-memory (passes in this run but fails in the 'main' branch)
Skipping an intermittent issue tests/date/date-locale-hour (passes in this run but fails in the 'main' branch)
Congrats! The gnu test tests/expand/bounded-memory is now passing!