M2: live netfilter data path (pf_test per direction), pfattach bring-up, NET_LOCK reentrancy fix, static pfctl

- pfk_hooks: PRE→PF_IN, LOCAL_OUT/POST→PF_OUT v4+v6; replacement/buffer
  handling with NF_STOLEN + re-injection (documented divergence: re-entry)
- pfk_mod: pf_status_init/pfattach + pfi attach via pfk_if event callback
- pfk_kern: NET_LOCK holder reentrancy (fix deadlock when notifier fires
  under the write lock — observed as full-VM network hang)
- tools: static pfctl link for musl VMs

tools/tests/01_basic.conf

@@ -0,0 +1,32 @@
+# PFLINUX offline parse test 1 — macros, tables, anchors, filter rules.
+# Only lo is referenced so the config parses on any Linux host.
+
+xif = "lo"
+int_net = "127.0.0.0/8"
+
+table <brutes> persist
+table <blocked> const { 10.0.0.0/8, 127.0.0.1 }
+table <web> const { $int_net }
+
+set skip on lo
+set block-policy return
+set loginterface $xif
+set ruleset-optimization basic
+set state-policy if-bound
+set timeout { tcp.established 3600, tcp.closed 90 }
+set limit states 100000
+set limit src-nodes 3000
+
+anchor "in/*"
+anchor "testsub" {
+	block drop in quick on $xif from <blocked> to any label "blocked-in"
+	pass in quick on $xif proto tcp from any to any port 22 keep state
+}
+
+load anchor "in/loaded" from "tests/anchor_loaded.conf"
+
+pass in quick on $xif inet proto tcp from any to any port { 80 443 8080 } \
+	tag WEB keep state (max 1000)
+pass in quick on $xif inet6 proto tcp from fe80::/10 to any port 443
+pass out quick on $xif proto udp from any to any port 53
+block drop in log quick on $xif from <brutes> to any