DF-2648 — HAMMER2IOC_VERSION_GET / HAMMER2IOC_INODE_GET ignore the privilege check

What

hammer2_ioctl() (sys/vfs/hammer2/hammer2_ioctl.c:83) computes error = caps_priv_check(cred, SYSCAP_NOVFS_IOCTL) and gates most commands on it, but two handlers overwrite the result instead of checking it:

• hammer2_ioctl.c:86-88 — VERSION_GET: error = hammer2_ioctl_version_get(...)
• hammer2_ioctl.c:137-139 — INODE_GET: error = hammer2_ioctl_inode_get(...)

(Same class as DF-0815, which covered BULKFREE_SCAN/ASYNC and DEBUG_DUMP; these two commands were not in that finding.)

Any user who can open a path on a hammer2 mount can therefore run HAMMER2IOC_INODE_GET and read the inode's kernel-side meta (hammer2_inode_data_t: inum, size, mode, uid/gid uuids, quotas, counts). The data is essentially stat(2)-equivalent, so the practical impact is low — this is a privilege-gating correctness bug (defense in depth, consistency with every other read-only-but-gated command such as PFS_GET/PFS_LOOKUP), not a disclosure of secret kernel state.

Reproduce (run on the stock guest, clean mounted image)

# vnconfig -c vn0 base2647.img && mount -t hammer2 /dev/vn0@testvol /mnt/h2
# chmod a+rx /mnt/h2
# su -m nobody -c "/tmp/inodeget_user /mnt/h2"
uid=65534 euid=65534 fd=3
INODE_GET: SUCCESS (ungated!) data_count=0 inode_count=0 inum=1
PFS_GET: errno=1 (Operation not permitted) -- gate works

The contrast line proves the gate exists and is enforced for other commands but ignored for INODE_GET.

Fix

Honor the check like the neighboring cases:

    case HAMMER2IOC_VERSION_GET:
-       error = hammer2_ioctl_version_get(ip, data);
+       if (error == 0)
+           error = hammer2_ioctl_version_get(ip, data);
        break;
    case HAMMER2IOC_INODE_GET:
-       error = hammer2_ioctl_inode_get(ip, data);
+       if (error == 0)
+           error = hammer2_ioctl_inode_get(ip, data);
        break;

(If the project prefers these to stay unprivileged-by-design, document it — but then hammer2(8) should not be the only expected caller.)