M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics

- hooks: packets are queued to pfk_netisr ordered wq (process context) and
  re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
  documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)

module/pfsrc/pfk_mod.c

@@ -123,13 +123,13 @@ static int __init pfk_init(void)
 	err = pfk_if_init();
 	if (err)
 		goto err_pcb;
-	/* OpenBSD bring-up order: status/pools/rulesets, then kifs */
-	pfk_net_lock();
+	/* OpenBSD bring-up order: status/pools/rulesets, then kifs.
+	 * No NET_LOCK here: pfattach/pfi take what locks they need (PF_LOCK),
+	 * and control ioctls serialize with NET_LOCK themselves. */
 	pf_status_init();
 	pfattach(0);
 	pfk_if_set_event_cb(pfk_pfi_event);
 	pfk_if_iterate(pfk_pfi_attach_one);
-	pfk_net_unlock();
 	err = pfk_hooks_register();
 	if (err)
 		goto err_if;