M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/include/netinet/ip.h

@@ -0,0 +1,44 @@
+/* PFLINUX: shadow <netinet/ip.h> — glibc's copy lacks the IPTOS_DSCP_CS*
+ * class-selector codepoints parse.y's `set tos` table references (plus a
+ * few neighbours); values copied verbatim from
+ * _vendor/openbsd/obbsd/sys/netinet/ip.h (OpenBSD 8.0). */
+#ifndef _PFLINUX_NETINET_IP_H
+#define _PFLINUX_NETINET_IP_H
+
+#include_next <netinet/ip.h>
+
+#ifndef IPTOS_DSCP_CS0
+#define	IPTOS_DSCP_CS0		0x00
+#endif
+#ifndef IPTOS_DSCP_LE
+#define	IPTOS_DSCP_LE		0x04
+#endif
+#ifndef IPTOS_DSCP_CS1
+#define	IPTOS_DSCP_CS1		0x20
+#endif
+#ifndef IPTOS_DSCP_CS2
+#define	IPTOS_DSCP_CS2		0x40
+#endif
+#ifndef IPTOS_DSCP_CS3
+#define	IPTOS_DSCP_CS3		0x60
+#endif
+#ifndef IPTOS_DSCP_CS4
+#define	IPTOS_DSCP_CS4		0x80
+#endif
+#ifndef IPTOS_DSCP_CS5
+#define	IPTOS_DSCP_CS5		0xa0
+#endif
+#ifndef IPTOS_DSCP_VA
+#define	IPTOS_DSCP_VA		0xb0
+#endif
+#ifndef IPTOS_DSCP_EF
+#define	IPTOS_DSCP_EF		0xb8
+#endif
+#ifndef IPTOS_DSCP_CS6
+#define	IPTOS_DSCP_CS6		0xc0
+#endif
+#ifndef IPTOS_DSCP_CS7
+#define	IPTOS_DSCP_CS7		0xe0
+#endif
+
+#endif /* _PFLINUX_NETINET_IP_H */