M1 progress: engine port compiles except pf.c; AF_DIVERT socket family; ifq framework

- compat layer extended through the full BSD API surface pf_ioctl/pf_lb/
  pf_if/pf_norm/pf_table/pf_ruleset/radix/md5/sha2 need (all compile):
  cpumem/counters model, ifaddr/ifg groups, cred view, endian+in6 names,
  NAT46/64, SipHash24, mbuf_list, frag6 helpers, ip6 forward/checksum,
  tcp options/FSM names, taskqueue & sysctl shims (documented in
  docs/porting-notes.md)
- pfsrc/divert_sock.c: real BSD divert(4) as runtime-registered PF_DIVERT=32
  socket family inside the module (sock_register; NPROTO=AF_MAX=45 -> zero
  core patches); divert_packet/divert6_packet wired for pf.c
- compat/pfk_ifq.c: OpenBSD 8.0 ifq framework with priq back end; hfsc and
  fq_codel aliases pending M5 (recorded in feature matrix as pending)
- design + plan updated for the divert decision (user-requested)
- stage-port.sh: single deterministic rename program for headers and .c

lab/cloud-init/network-config.cli.tmpl

@@ -11,4 +11,4 @@ ethernets:
     match: {macaddress: "@CLI_MAC_LAN@"}
     addresses: [@CLI@]
     routes:
-      - {to: default, via: @CLI_GW@}
+      - {to: 0.0.0.0/0, via: @CLI_GW@}

lab/cloud-init/network-config.gw2.tmpl

@@ -9,5 +9,6 @@ ethernets:
   wan:
     match: {macaddress: "@GW2_MAC_WAN@"}
     addresses: [@GW2_WAN@]
+    nameservers: {addresses: ["192.168.122.1"]}
     routes:
-      - {to: default, via: @PF0_WAN_IP@}
+      - {to: 0.0.0.0/0, via: @PF0_WAN_IP@}

lab/cloud-init/network-config.srv.tmpl

@@ -11,5 +11,5 @@ ethernets:
     match: {macaddress: "@SRV_MAC_WAN@"}
     addresses: [@SRV@]
     routes:
-      - {to: default, via: @SRV_GW@}
+      - {to: 0.0.0.0/0, via: @SRV_GW@}
       - {to: 10.0.3.0/24, via: @GW2_WAN_IP@}

lab/cloud-init/user-data.tmpl

@@ -17,8 +17,10 @@ chpasswd:
 package_update: true
 packages: @LAB_PACKAGES@
 runcmd:
-  - echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/00-pflab.conf
-  - sysctl -q -p /etc/sysctl.d/00-pflab.conf
+  - |
+    printf 'net.ipv4.ip_forward=1\nnet.ipv4.conf.all.rp_filter=0\nnet.ipv4.conf.default.rp_filter=0\n' > /etc/sysctl.d/00-pflab.conf
+    sysctl -q -p /etc/sysctl.d/00-pflab.conf
+    for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > "$f"; done
   - "printf '@ROOT_PASS@\\n@ROOT_PASS@\\n' | passwd root >/dev/null 2>&1 || true"
 @RUNCMD_EXTRA@
   - touch /run/pf-lab-ready