M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

module/compat/pfk_mbuf.c

@@ -50,6 +50,30 @@ pfk_m_setpkthdr(struct mbuf *m)
 	m->m_pkthdr.tags = NULL;
 }
 
+/*
+ * Ingress wrapper for netfilter hook skbs: takes an EXTRA skb reference so
+ * the wrapper can be consumed (m_freem) without disturbing netfilter's own
+ * reference; fills the pkthdr the way OpenBSD's ip_input/ip_output does.
+ */
+struct mbuf *
+pfk_m_wrap_skb(struct sk_buff *skb, int af)
+{
+	struct mbuf *m;
+
+	skb_get(skb);
+	m = m_alloc_skb(skb, M_NOWAIT);
+	if (!m)
+		return NULL;
+	m->m_pkthdr.af = af;
+	m->m_pkthdr.proto = (af == AF_INET) ?
+		((struct pf_ip *)skb->data)->ip_p : -1;
+	m->m_pkthdr.ph_ifidx = skb->dev ? skb->dev->ifindex : 0;
+	m->m_pkthdr.ifp = m->m_pkthdr.rcvif =
+		skb->dev ? pfk_ifp_bydev(skb->dev) : NULL;
+	m->m_pkthdr.ph_rtableid = 0;
+	return m;
+}
+
 struct mbuf *
 m_alloc_skb(struct sk_buff *skb, int how)
 {