Fix SELinux backup execution context and probe source metadata before downtime

usr-local-sbin/app-backup.sh

@@ -24,7 +24,7 @@ init_runtime
 build_plan
 preflight
 if [[ $CHECK == true ]]; then
-  echo 'Preflight passed. No source copy, service stop, dump, upload or deletion performed.'
+  echo 'Preflight passed. Directory metadata probed; no application backup, service stop or upload performed.'
   exit 0
 fi
 STAGING_DIR=$(mktemp -d "$STAGING_ROOT/${RUN_ID}.XXXXXX")
@@ -58,7 +58,8 @@ for i in "${!LABELS[@]}"; do
   exclusions "$label"
   echo "-- Copy: $label ($src)"
   # Never accept vanished-file (24) or partial-copy (23) as success.
-  rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$src/" "$STAGING_DIR/$root/"
+  # Parent retains both locks; rsync itself needs neither inherited descriptor.
+  rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$src/" "$STAGING_DIR/$root/" 8>&- 9>&-
   printf '%s\t%s\n' "$label" "$src" >> "$PLAN"
 done
 # The full consistency window includes all dumps AND copies. Compression/upload