M1: vendored sha2/md5 (OpenBSD 8.0) + endian/swap compat; module builds green

lab/ips.env

@@ -52,7 +52,9 @@ GW2_MAC_WAN2=52:54:00:dd:00:02
 
 # --- root creds / packages (cloud-init) ---
 ROOT_PASS=pftest
-LAB_PACKAGES='[iperf3, tcpdump, python3, py3-scapy, bash]'
+# NOTE: Alpine name is 'scapy' (py3-scapy doesn't exist); iptables added —
+# the cloud image ships without it and pf0 needs it for masquerade.
+LAB_PACKAGES='[iperf3, tcpdump, python3, scapy, bash, iptables]'
 
 # --- paths ---
 IMG_DIR=/var/lib/libvirt/images