M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/tests/03_queues_scrub.conf

@@ -0,0 +1,18 @@
+# PFLINUX offline parse test 3 — HFSC/fq_codel queues, scrub, limits, delay.
+
+xif = "lo"
+
+queue rootq on $xif bandwidth 1G, max 900M, min 10M
+queue rtq on $xif bandwidth 100M burst 200M for 50ms parent rootq qlimit 500
+queue bulkq on $xif bandwidth 50M, min 5M parent rootq default
+queue fqcq on $xif bandwidth 20M flows 1024 quantum 1514 parent rootq
+
+set timeout { frag 20, interval 10 }
+set limit frags 10000
+
+match in on $xif proto tcp all scrub (random-id)
+match in on $xif inet proto tcp all scrub (max-mss 1440 min-ttl 10)
+pass in quick on $xif proto tcp from any to any port 80 queue rtq
+pass out quick on $xif proto tcp from any to any queue bulkq
+pass in quick on $xif proto udp from any to any queue fqcq
+block drop in quick on $xif all