vfs_mount caches mnt_cred with unlocked check-then-set

Summary

vfs_mount(:90-91) check-then-set mp->mnt_cred with no lock when MNTK_MPSAFE (VFS_MPLOCK no-op). Safe today (caller holds mnt_token). MNT_UPDATE stale mnt_cred never refreshed. Fragile.