M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

module/compat/pfk_kern.c

@@ -100,10 +100,28 @@ taskq_create(const char *name, unsigned int nthreads, int ipl,
 /* ---------------- NET_LOCK ---------------- */
 static DECLARE_RWSEM(pfk_net_sem);
 static atomic_t pfk_net_readers = ATOMIC_INIT(0);
+static atomic_t pfk_net_owner = ATOMIC_INIT(0);	/* task pid holding write */
 
 void pfk_net_lock_init(void) { }
-void pfk_net_lock(void)        { down_write(&pfk_net_sem); }
-void pfk_net_unlock(void)      { up_write(&pfk_net_sem); }
+void
+pfk_net_lock(void)
+{
+	/* Re-entrant for the holder: OpenBSD's NET_LOCK is friendly with
+	 * nested calls in the same path (e.g. our netdev notifier firing
+	 * while pfioctl holds the lock). */
+	if (atomic_read(&pfk_net_owner) == current->pid)
+		return;
+	down_write(&pfk_net_sem);
+	atomic_set(&pfk_net_owner, current->pid);
+}
+void
+pfk_net_unlock(void)
+{
+	if (atomic_read(&pfk_net_owner) != current->pid)
+		return;		/* nested no-op for non-holders */
+	atomic_set(&pfk_net_owner, 0);
+	up_write(&pfk_net_sem);
+}
 void pfk_net_read_enter(void)  { down_read(&pfk_net_sem);
 				 atomic_inc(&pfk_net_readers); }
 void pfk_net_read_release(void){ atomic_dec(&pfk_net_readers);