Cluster array chain pointer read without cluster_spin UAF in volume dedup check

Summary

hammer2_xop_inode_flush volume-header dedup check :1377-1384 reads ip->cluster.array[j].chain dereferences chain->hmp without holding ip->cluster_spin. Cluster array concurrently modified under cluster_spin by hammer2_inode_repoint (inode.c:1400-1454) replaces chain pointers drops old chain ref outside spin (:1459-1461). If repoint runs between pointer read and hmp deref old chain freed UAF on chain->hmp. Proper pattern (inode.c:413-425) takes cluster_spin shared refs chain drops spin. Requires clustered HAMMER2 config.