M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/tests/01_basic.conf

@@ -0,0 +1,32 @@
+# PFLINUX offline parse test 1 — macros, tables, anchors, filter rules.
+# Only lo is referenced so the config parses on any Linux host.
+
+xif = "lo"
+int_net = "127.0.0.0/8"
+
+table <brutes> persist
+table <blocked> const { 10.0.0.0/8, 127.0.0.1 }
+table <web> const { $int_net }
+
+set skip on lo
+set block-policy return
+set loginterface $xif
+set ruleset-optimization basic
+set state-policy if-bound
+set timeout { tcp.established 3600, tcp.closed 90 }
+set limit states 100000
+set limit src-nodes 3000
+
+anchor "in/*"
+anchor "testsub" {
+	block drop in quick on $xif from <blocked> to any label "blocked-in"
+	pass in quick on $xif proto tcp from any to any port 22 keep state
+}
+
+load anchor "in/loaded" from "tests/anchor_loaded.conf"
+
+pass in quick on $xif inet proto tcp from any to any port { 80 443 8080 } \
+	tag WEB keep state (max 1000)
+pass in quick on $xif inet6 proto tcp from fe80::/10 to any port 443
+pass out quick on $xif proto udp from any to any port 53
+block drop in log quick on $xif from <brutes> to any

tools/tests/02_translations.conf

@@ -0,0 +1,23 @@
+# PFLINUX offline parse test 2 — translations, redirections, diversion.
+
+xif = "lo"
+table <ext> const { 127.0.0.1 }
+
+set reassemble yes no-df
+set syncookies adaptive (start 25%, end 12%)
+
+pass in quick on $xif inet proto tcp from any to any port 8080 \
+	rdr-to 127.0.0.1 port 80 sticky-address
+pass out quick on $xif inet proto tcp from 127.0.0.0/8 to any \
+	nat-to <ext> static-port
+pass in quick on $xif inet6 proto tcp from any to any port 8080 \
+	rdr-to ::1
+pass in quick on $xif inet proto tcp from any to any port 1723 \
+	route-to 127.0.0.1
+pass in quick on $xif proto tcp from any to any port 21 \
+	divert-to 127.0.0.1 port 7000
+pass in quick on $xif proto tcp from any to any port 110 divert-packet port 2000
+pass quick on $xif inet proto tcp from 127.0.0.5 to any binat-to 127.0.0.9
+pass in quick on $xif inet proto tcp all af-to inet6 from ::1
+match out quick on $xif inet proto tcp all set (delay 100)
+block drop in quick on $xif inet from urpf-failed to any

tools/tests/03_queues_scrub.conf

@@ -0,0 +1,18 @@
+# PFLINUX offline parse test 3 — HFSC/fq_codel queues, scrub, limits, delay.
+
+xif = "lo"
+
+queue rootq on $xif bandwidth 1G, max 900M, min 10M
+queue rtq on $xif bandwidth 100M burst 200M for 50ms parent rootq qlimit 500
+queue bulkq on $xif bandwidth 50M, min 5M parent rootq default
+queue fqcq on $xif bandwidth 20M flows 1024 quantum 1514 parent rootq
+
+set timeout { frag 20, interval 10 }
+set limit frags 10000
+
+match in on $xif proto tcp all scrub (random-id)
+match in on $xif inet proto tcp all scrub (max-mss 1440 min-ttl 10)
+pass in quick on $xif proto tcp from any to any port 80 queue rtq
+pass out quick on $xif proto tcp from any to any queue bulkq
+pass in quick on $xif proto udp from any to any queue fqcq
+block drop in quick on $xif all

tools/tests/anchor_loaded.conf

@@ -0,0 +1,4 @@
+# PFLINUX offline parse test 1 — anchor body loaded from a file.
+
+block drop in quick on lo proto tcp from any to any port 139
+pass in quick on lo proto tcp from 127.0.0.0/8 to any port 389 tag LDAP

tools/tests/broken.conf

@@ -0,0 +1,5 @@
+# PFLINUX offline parse test — intentionally BROKEN config.
+# `port` with no port spec is a syntax error; pfctl -n must exit non-zero.
+
+xif = "lo"
+pass in quick on $xif all port