test(vm): add stress gate 16 and its report runner

Gate 16 asserts invariants under load: states tracked under concurrent
connections and drained again, 200 ruleset reloads without failure, 2000
table entries flushed back to zero, 2 MB intact through NAT under a
concurrent stream, no kernel faults. Throughput is measured and reported
rather than gated, and the traffic phases run at a bounded rate because
the PF workqueue backlog exhausts a 1 GB guest above ~1 Gbit/s.

The runner writes out/stress/<timestamp>/report.md and captures the guest
serial console so a panic stays diagnosable.

Makefile

@@ -1,7 +1,7 @@
 # PF-on-Linux top-level make
 KERNELDIR ?= $(HOME)/lab/linux_kernel/linux-7.3.4
 
-.PHONY: module tools kernel test clean vm vm-destroy docs demo
+.PHONY: module tools kernel test stress clean vm vm-destroy docs demo
 
 module:
 	$(MAKE) -C $(KERNELDIR) M=$(CURDIR)/module modules
@@ -21,6 +21,12 @@ vm-destroy:
 test:
 	./scripts/vm-run-tests.sh
 
+# Stress: throughput/state/rule/table churn against the lab, with a report in
+# out/stress/<timestamp>/report.md.  Pass options through, e.g.
+#   make stress ARGS="--quick"
+stress:
+	./scripts/stress/run-stress.sh $(ARGS)
+
 docs:
 	@for f in docs/en/*.md; do echo "EN  $$f"; done
 	@for f in docs/pt-BR/*.md; do echo "PT  $$f"; done