M2 data path: BSD netisr workqueue + lock reentrancy fixes + diagnostics

- hooks: packets are queued to pfk_netisr ordered wq (process context) and
  re-injected with an skb->mark guard (PFK_MARK_PASSED); softirq-safe,
  documented divergence vs OpenBSD in-place ip_input continuation
- pfk_rwlock: per-task writer recursion (NET/PF lock nesting like OpenBSD)
- pfk_net: holder-task+depth reentrancy (pid-based hack removed)
- ifnet events deferred to ordered workqueue (rtnl AB-BA fix)
- idr iteration start index fix (kifs were never attached -> kif==NULL drop)
- pfk_lock_trace module param for lock diagnostics
- tests/vm: 01-state 02-block 03-tables 04-anchors + lib; vm-run-tests.sh
- docs/en/install.md: apply/build guide (core patch set currently EMPTY)

tests/vm/lib.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# helpers for tests/vm/*
+DEB="${DEB:-root@192.168.1.242}"
+PF0_IP="${PF0_IP:-192.168.122.8}"
+CLI_IP=10.0.1.10; SRV_IP=10.0.2.20; GW2_IP=10.0.3.2; GW2_WAN=10.0.2.2
+pf0() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"$*\"" ; }
+cli() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"ssh -o StrictHostKeyChecking=accept-new root@$CLI_IP '$*'\"" ; }
+srv() { ssh -o ConnectTimeout=10 "$DEB" "ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 -i /root/.ssh/pflab_ed root@$PF0_IP \"ssh -o StrictHostKeyChecking=accept-new root@$SRV_IP '$*'\"" ; }
+ok()   { echo "OK $*"; }
+bad()  { echo "NOT OK: $*" >&2; FAILED=1; }
+finish(){ [ "${FAILED:-0}" = 1 ] && exit 1; exit 0; }