M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

module/include/pfk_if.h

@@ -86,6 +86,12 @@ struct pfk_ifnet *pfk_if_next(struct pfk_ifnet *ifp);
 struct pfk_ifnet *pfk_if_next_from(int *idp);
 struct net_device *ip_rt_get_default_dev(struct net *net);
 
+/* Notification for PF engine (pfi attach/detach), called under NET_LOCK:
+ * added=1 new interface (after populate), added=0 interface going away. */
+void pfk_if_set_event_cb(void (*cb)(int added, struct pfk_ifnet *ifp));
+/* Iterate all live interfaces with cb(ifp) under NET_LOCK-read. */
+void pfk_if_iterate(void (*cb)(struct pfk_ifnet *ifp));
+
 /* xmit API used by pf_route/pf output (implemented in pfk_xmit.c).
  * PFLINUX: `dst` is void * so BSD accessor macros (sintosa/sin6tosa,
  * which keep the sockaddr_in/sockaddr_in6 type for field access) can be

module/include/pfk_mbuf.h

@@ -141,6 +141,8 @@ struct mbuf {
 struct mbuf *m_get(int how, short type);
 struct mbuf *m_gethdr(int how, short type);
 struct mbuf *m_alloc_skb(struct sk_buff *skb, int how); /* wrap borrowed skb */
+struct mbuf *pfk_m_wrap_skb(struct sk_buff *skb, int af); /* ingress: extra ref */
+struct mbuf *pfk_m_wrap_skb(struct sk_buff *skb, int af); /* ingress: takes extra ref */
 struct mbuf *m_devget(char *buf, int totlen, int off,
 		      struct pfk_ifnet *ifp, void (*copyin_fc)(caddr_t, int));
 void  pfk_m_setpkthdr(struct mbuf *m);