M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

module/pfsrc/pfk_mod.c

@@ -91,6 +91,24 @@ static struct miscdevice pfk_dev = {
 	.mode	= 0600,
 };
 
+extern void pf_status_init(void);
+extern int pfattach(int);
+
+static void
+pfk_pfi_event(int added, struct pfk_ifnet *ifp)
+{
+	if (added)
+		pfi_attach_ifnet(ifp);
+	else
+		pfi_detach_ifnet(ifp);
+}
+
+static void
+pfk_pfi_attach_one(struct pfk_ifnet *ifp)
+{
+	pfi_attach_ifnet(ifp);
+}
+
 static int __init pfk_init(void)
 {
 	int err;
@@ -105,6 +123,13 @@ static int __init pfk_init(void)
 	err = pfk_if_init();
 	if (err)
 		goto err_pcb;
+	/* OpenBSD bring-up order: status/pools/rulesets, then kifs */
+	pfk_net_lock();
+	pf_status_init();
+	pfattach(0);
+	pfk_if_set_event_cb(pfk_pfi_event);
+	pfk_if_iterate(pfk_pfi_attach_one);
+	pfk_net_unlock();
 	err = pfk_hooks_register();
 	if (err)
 		goto err_if;