# DF-5797 — utimensat/futimens: non-owner with write permission can set arbitrary file timestamps

## What
`kern_utimensat()` (sys/kern/vfs_syscalls.c:3961) and `kern_futimens()`
(sys/kern/vfs_syscalls.c:3847) gate the whole timestamp operation on
`NLC_OWN | NLC_WRITE`, which naccess_lva() evaluates as
**owner OR write-permission**. Neither path checks whether the
user-supplied timespecs are arbitrary (POSIX allows arbitrary values
only for the owner / privileged users; write access alone permits only
the *current* time). On filesystems that do not re-check ownership in
VOP_SETATTR — HAMMER2, the default root FS, unlike UFS
(sys/vfs/ufs/ufs_vnops.c:462-468) — the arbitrary times are accepted.

## Reproduce (on the guest)
```
# root:
sh /tmp/setup_root.sh          # creates /tmp/df5797_target (root:wheel 666)
cc -O -o /tmp/utimes_forge /tmp/utimes_forge.c
chown maxx /tmp/utimes_forge
# unprivileged user (maxx, uid 1001):
/tmp/utimes_forge /tmp/df5797_target
```

## Expected (vulnerable) output
```
uid=1001  file owner=0 mode=100666
utimensat(arbitrary)      -> OK          <- POSIX says EPERM here
  after utimensat            atime=0 mtime=66666
utimensat(nofollow,mixed)-> OK
futimens(arbitrary)       -> OK          <- POSIX says EPERM here
  after futimens            atime=12345678 mtime=12345678
```
Control (mode 644 file, no write perm) correctly returns EACCES — proving
the gate is exactly "write permission", not ownership.

## Impact
Any local user with *write* access to a file they do not own can forge
arbitrary atime/mtime — including restoring original timestamps after
modifying content. This defeats timestamp-based incremental backups
(rsync -a, tar), build systems (make), and forensic/audit triage that
assume POSIX utimes semantics (FreeBSD/Linux/POSIX all return EPERM).