M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/include/sys/sysctl.h

@@ -0,0 +1,28 @@
+/* PFLINUX: <sys/sysctl.h> — OpenBSD sysctl(3) surface used by pfctl.
+ * Linux removed both <sys/sysctl.h> and the legacy sysctl(2) syscall; the
+ * constants below mirror OpenBSD 8.0 (sys/sysctl.h) and sysctl() is
+ * implemented in tools/compat-user/sysctl.c for exactly the three MIBs
+ * pfctl queries. */
+#ifndef _PFLINUX_SYS_SYSCTL_H
+#define _PFLINUX_SYS_SYSCTL_H
+
+#include <sys/types.h>
+#include <stddef.h>
+
+#define CTL_UNSPEC		0
+#define CTL_KERN		1
+#define CTL_VM			2
+#define CTL_NET			4	/* PF_ROUTE etc. */
+#define CTL_HW			6
+
+#define KERN_MAXCLUSTERS	67	/* int: mbuf cluster limit */
+#define HW_PHYSMEM64		19	/* int64_t: total RAM */
+
+struct kinfo_proc;		/* forward: nothing pfctl uses, avoid clash */
+
+__BEGIN_DECLS
+int	 sysctl(const int *name, u_int namelen, void *old, size_t *oldlenp,
+	    const void *new, size_t newlen);
+__END_DECLS
+
+#endif /* _PFLINUX_SYS_SYSCTL_H */