M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics

- hooks: packets are queued to pfk_netisr ordered wq (process context) and
  re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
  documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)

module/include/pfk.h

@@ -294,6 +294,11 @@ struct pfk_rwlock {
 	const char		*name;
 	int			 is_writer;
 	atomic_t		 readers;
+	/* PFLINUX: OpenBSD rw_enter(WRITER) recursion must not self-deadlock
+	 * (pfioctl holds PF_LOCK and re-enters via helpers); rw_semaphores are
+	 * non-recursive, so track writer identity + depth. */
+	struct task_struct	*owner;
+	int			 wdepth;
 };
 #define rwlock pfk_rwlock
 #define rwlock_s pfk_rwlock