chore: repo scaffold, READMEs (EN/pt-BR), version pins, source fetch+vendorize scripts

- pins OpenBSD 8.0 tarballs (sha256) and Linux 7.3.4 as the port targets
- scripts/fetch-sources.sh (C3SL primary, cdn fallback), scripts/vendorize.sh
- scripts/{kernel-config,build-kernel}.sh for the VM-lab kernel

README.md

@@ -0,0 +1,58 @@
+# PF on Linux
+
+Port of the OpenBSD **PF** (packet filter) to **Linux 7.3.4** as out-of-tree
+kernel modules — the real PF engine (`pf.c`, `pf_norm.c`, `pf_table.c`,
+`pf_lb.c`, … ported from OpenBSD 8.0 sources) driven by the real OpenBSD
+`pfctl` over the `/dev/pf` ioctl ABI.
+
+**Status:** implementation in progress — see
+[`docs/superpowers/plans/2026-11-11-pf-linux-port.md`](docs/superpowers/plans/2026-11-11-pf-linux-port.md)
+for task progress and
+[`docs/superpowers/specs/2026-11-11-pf-linux-port-design.md`](docs/superpowers/specs/2026-11-11-pf-linux-port-design.md)
+for the design.
+
+## What you get (planned)
+
+| Area | Feature |
+|---|---|
+| Filtering | rules, anchors, quick, `match`/`block`(drop/return/return-rst)/`pass`, `keep state`, syncookies |
+| State/Tables | stateful firewall engine, `pfr` tables (radix + hash, `pfctl -t`) |
+| NAT | `nat-to` (port pools, sticky-port, static-port), `rdr-to`, `binat-to` |
+| Scrub | fragment reassembly, overlap drop, `min-ttl`/`max-mss`/`df`/`no-df`, `set reassemble` |
+| QoS (ALTQ successor) | `queue`/`queue on` with OpenBSD 8.0 `ifq` schedulers: **default (priq), HFSC, FQ-CoDel**, attached via the `pfq` qdisc; `pfctl -s queue -v` stats |
+| Divert | `divert-to` / `divert` tag + `pdivert` userspace channel (netlink; Linux has no `AF_DIVERT`) |
+| Route | `route-to` (pools rr/hash-source/hash-state, `fail-to`), `reply-to`, `dup-to` |
+| Logging | `pflogd` via netlink pflog channel (DLT_PFLOG pcap) |
+| Control | `/dev/pf` (0600), OpenBSD 8.0 ioctl ABI, Linux build of `pfctl` (single binary) |
+
+Not in scope: `pfsync`/CARP failover, IPsec/pfkey, `ftp-proxy`, per-netns PF
+instances, classic-ALTQ-only schedulers (cbq/wfq/red — removed upstream before
+OpenBSD 8.0).
+
+## Quick start (after M1+)
+
+```sh
+./scripts/fetch-sources.sh          # OpenBSD 8.0 sources (C3SL mirror, checksummed)
+./scripts/apply-patches.sh ../linux-7.3.4   # core export patch(es)
+make module tools                   # pf.ko, pfq.ko, pfctl, pdivert, pflogd
+sudo insmod module/pf.ko module/pfq.ko
+sudo pfctl -f /etc/pf.conf && sudo pfctl -e
+```
+
+VM validation lab (Alpine on libvirt): see `docs/en/vm-lab.md`.
+Documentação em português: [`README.pt-BR.md`](README.pt-BR.md) e `docs/pt-BR/`.
+
+## Layout
+
+- `module/` — kernel sources (ported PF + compat layer + pfq qdisc)
+- `tools/` — pfctl/pdivert/pflogd Linux builds
+- `patches/kernel/` — documented Linux core patches (export symbols only)
+- `scripts/` — fetch/build/patch/VM automation
+- `tests/` — VM suite (`tests/vm/NN-*.sh`, scapy helpers)
+- `docs/en/` + `docs/pt-BR/` — full bilingual documentation
+- `docs/superpowers/` — design spec + implementation plan
+
+## License
+
+Ported OpenBSD code retains its original [ISC license and copyright notices](LICENSE).
+New Linux-side code: ISC.