M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics

- hooks: packets are queued to pfk_netisr ordered wq (process context) and
  re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
  documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)

scripts/vm-run-tests.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# VM lab test runner. Executes tests/vm/*.sh against the pftest-* lab via
+# nested ssh (deb host → VM). Collects per-test PASS/FAIL + logs into
+# out/test-logs/. Exit 0 only if every gate test passes.
+set -uo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+LOGD="$REPO/out/test-logs"; mkdir -p "$LOGD"
+DEB="${DEB:-root@192.168.1.242}"
+source "$REPO/lab/ips.env" 2>/dev/null || true
+
+vm() { # vm <alias> <cmd...>
+	local alias="$1"; shift
+	ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@${!alias:-$(grep -h "^${alias^^}=" "$REPO/lab/ips.env" 2>/dev/null | cut -d= -f2)} \"$*\""
+}
+
+PUSH=0 FAIL=0 SKIP=0
+for t in "$REPO"/tests/vm/[0-9]*.sh; do
+	[ -e "$t" ] || continue
+	name="$(basename "$t")"
+	echo "=== $name ==="
+	if bash "$t" >"$LOGD/$name.log" 2>&1; then
+		echo "PASS $name"; PUSH=$((PUSH+1))
+	else
+		rc=$?
+		if [ $rc -eq 77 ]; then echo "SKIP $name"; SKIP=$((SKIP+1));
+		else echo "FAIL $name (rc=$rc, log $LOGD/$name.log)"; FAIL=$((FAIL+1)); fi
+	fi
+done
+echo "----------------------------------------"
+echo "PASS=$PUSH FAIL=$FAIL SKIP=$SKIP"
+[ $FAIL -eq 0 ]