M1 progress: engine port compiles except pf.c; AF_DIVERT socket family; ifq framework

- compat layer extended through the full BSD API surface pf_ioctl/pf_lb/
  pf_if/pf_norm/pf_table/pf_ruleset/radix/md5/sha2 need (all compile):
  cpumem/counters model, ifaddr/ifg groups, cred view, endian+in6 names,
  NAT46/64, SipHash24, mbuf_list, frag6 helpers, ip6 forward/checksum,
  tcp options/FSM names, taskqueue & sysctl shims (documented in
  docs/porting-notes.md)
- pfsrc/divert_sock.c: real BSD divert(4) as runtime-registered PF_DIVERT=32
  socket family inside the module (sock_register; NPROTO=AF_MAX=45 -> zero
  core patches); divert_packet/divert6_packet wired for pf.c
- compat/pfk_ifq.c: OpenBSD 8.0 ifq framework with priq back end; hfsc and
  fq_codel aliases pending M5 (recorded in feature matrix as pending)
- design + plan updated for the divert decision (user-requested)
- stage-port.sh: single deterministic rename program for headers and .c

scripts/vm-create.sh

@@ -28,7 +28,6 @@ done
 
 lab_env
 command -v rsync >/dev/null || die "rsync missing on laptop"
-command -v genisoimage >/dev/null 2>&1 || true  # iso is built on deb, not here
 
 host_prereqs
 ensure_networks
@@ -55,7 +54,9 @@ if [ -n "$PF0_KERNEL" ]; then
       rsync -a -e "ssh ${SSH_OPTS[*]}" "$PF0_INITRD" "$DEB_USER@$DEB:$BOOT_DIR/initrd"
       IPATH="$BOOT_DIR/initrd"
     fi
-    PF0_KB="    <kernel>$KPATH</kernel>"$'\n'"    <initrd>$IPATH</initrd>"$'\n'"    <cmdline>root=/dev/vda2 ro console=ttyS0,115200n8</cmdline>"
+    # with an initrd, Alpine's initramfs needs its module list on the cmdline;
+    # the no-initrd (built-in drivers, T6) case keeps the plain contract cmdline
+    PF0_KB="    <kernel>$KPATH</kernel>"$'\n'"    <initrd>$IPATH</initrd>"$'\n'"    <cmdline>root=/dev/vda2 ro console=ttyS0,115200n8 modules=sd-mod,usb-storage,ext4,ena,gve</cmdline>"
   fi
   log "pf0 direct kernel boot override: $KPATH"
 fi
@@ -72,6 +73,6 @@ deb_ssh_config
 laptop_ssh_config
 
 log "validate: ssh pf0 'ip -br a'"
-ssh "${SSH_OPTS[@]}" pf0 'ip -br a' || warn "ssh pf0 failed — check $LAPTOP_SSH_FRAG"
+ssh "${SSH_OPTS[@]}" pf0 'ip -br a' || die "ssh pf0 failed — check $LAPTOP_SSH_FRAG"
 log "LAB UP: aliases on laptop: ssh pf0|cli|srv|gw2  (ProxyJump $DEB_USER@$DEB)"
 deb "virsh list" || true