M1: vendored sha2/md5 (OpenBSD 8.0) + endian/swap compat; module builds green

lab/cloud-init/user-data.tmpl

@@ -14,6 +14,7 @@ chpasswd:
     - name: root
       password: "@ROOT_PASS@"
       type: text
+package_update: true
 packages: @LAB_PACKAGES@
 runcmd:
   - echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/00-pflab.conf

lab/ips.env

@@ -52,7 +52,9 @@ GW2_MAC_WAN2=52:54:00:dd:00:02
 
 # --- root creds / packages (cloud-init) ---
 ROOT_PASS=pftest
-LAB_PACKAGES='[iperf3, tcpdump, python3, py3-scapy, bash]'
+# NOTE: Alpine name is 'scapy' (py3-scapy doesn't exist); iptables added —
+# the cloud image ships without it and pf0 needs it for masquerade.
+LAB_PACKAGES='[iperf3, tcpdump, python3, scapy, bash, iptables]'
 
 # --- paths ---
 IMG_DIR=/var/lib/libvirt/images