M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/include/sys/timeout.h

@@ -0,0 +1,18 @@
+/* PFLINUX: <sys/timeout.h> — pfvar.h embeds struct timeout by value inside
+ * struct pf_pktdelay.  pf_pktdelay is kernel-internal only (it never
+ * appears in any ioctl payload; the kernel side uses the real
+ * module/include/compat/sys/timeout.h with linux/timer.h), so userland
+ * just needs the type to be complete for pfvar.h to compile. */
+#ifndef _PFLINUX_SYS_TIMEOUT_H
+#define _PFLINUX_SYS_TIMEOUT_H
+
+#include <sys/types.h>
+
+typedef void (timeout_fn)(void *);
+
+struct timeout {
+	timeout_fn	*fn;
+	void		*arg;
+};
+
+#endif /* _PFLINUX_SYS_TIMEOUT_H */