M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/.gitignore

@@ -0,0 +1,9 @@
+# PFLINUX build products
+out/
+# generated copies (regenerated by `make` each build; never hand-edit)
+include/net/pfvar.h
+include/net/radix.h
+include/net/hfsc.h
+include/net/fq_codel.h
+include/sys/tree.h
+include/sys/queue.h