# DF-2648 — HAMMER2IOC_VERSION_GET / HAMMER2IOC_INODE_GET ignore the privilege check

## What

`hammer2_ioctl()` (`sys/vfs/hammer2/hammer2_ioctl.c:83`) computes
`error = caps_priv_check(cred, SYSCAP_NOVFS_IOCTL)` and gates most
commands on it, but two handlers **overwrite** the result instead of
checking it:

* `hammer2_ioctl.c:86-88` — VERSION_GET: `error = hammer2_ioctl_version_get(...)`
* `hammer2_ioctl.c:137-139` — INODE_GET: `error = hammer2_ioctl_inode_get(...)`

(Same class as DF-0815, which covered BULKFREE_SCAN/ASYNC and DEBUG_DUMP;
these two commands were not in that finding.)

Any user who can open a path on a hammer2 mount can therefore run
HAMMER2IOC_INODE_GET and read the inode's kernel-side meta
(hammer2_inode_data_t: inum, size, mode, uid/gid uuids, quotas, counts).
The data is essentially stat(2)-equivalent, so the practical impact is
low — this is a privilege-gating correctness bug (defense in depth,
consistency with every other read-only-but-gated command such as
PFS_GET/PFS_LOOKUP), not a disclosure of secret kernel state.

## Reproduce (run on the stock guest, clean mounted image)

```
# vnconfig -c vn0 base2647.img && mount -t hammer2 /dev/vn0@testvol /mnt/h2
# chmod a+rx /mnt/h2
# su -m nobody -c "/tmp/inodeget_user /mnt/h2"
uid=65534 euid=65534 fd=3
INODE_GET: SUCCESS (ungated!) data_count=0 inode_count=0 inum=1
PFS_GET: errno=1 (Operation not permitted) -- gate works
```

The contrast line proves the gate exists and is enforced for other
commands but ignored for INODE_GET.

## Fix

Honor the check like the neighboring cases:

```diff
 	case HAMMER2IOC_VERSION_GET:
-		error = hammer2_ioctl_version_get(ip, data);
+		if (error == 0)
+			error = hammer2_ioctl_version_get(ip, data);
 		break;
 	case HAMMER2IOC_INODE_GET:
-		error = hammer2_ioctl_inode_get(ip, data);
+		if (error == 0)
+			error = hammer2_ioctl_inode_get(ip, data);
 		break;
```

(If the project prefers these to stay unprivileged-by-design, document it
— but then hammer2(8) should not be the only expected caller.)