chore: repo scaffold, READMEs (EN/pt-BR), version pins, source fetch+vendorize scripts

- pins OpenBSD 8.0 tarballs (sha256) and Linux 7.3.4 as the port targets
- scripts/fetch-sources.sh (C3SL primary, cdn fallback), scripts/vendorize.sh
- scripts/{kernel-config,build-kernel}.sh for the VM-lab kernel

scripts/build-kernel.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Build Linux 7.3.4 (VM-lab config) + collect boot artifacts into out/.
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+K="${KERNELDIR:-$(cd "$REPO/../linux-7.3.4" && pwd)}"
+cd "$K"
+"$REPO/scripts/kernel-config.sh" "${1:-}"
+JOBS="${JOBS:-$(($(nproc)-2))}"
+make -j"$JOBS" -s bzImage modules
+mkdir -p "$REPO/out"
+KVER="$(make -s kernelversion)"
+cp -f arch/x86/boot/bzImage "$REPO/out/linux-${KVER}-bzImage"
+cp -f System.map "$REPO/out/System.map"
+cp -f .config "$REPO/out/.config"
+make -s kernelrelease > "$REPO/out/kernelversion"
+sha256sum "$REPO/out/linux-${KVER}-bzImage" > "$REPO/out/bzImage.sha256"
+echo "KERNEL_BUILD_OK $(cat "$REPO/out/kernelversion")"

scripts/fetch-sources.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Fetch OpenBSD 8.0 source tarballs (primary mirror: user-provided C3SL;
+# fallback: cdn.openbsd.org) and verify against VERSIONS pins.
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+V="$REPO/_vendor/openbsd"; mkdir -p "$V"
+MIRROR_PRIMARY="https://openbsd.c3sl.ufpr.br/pub/OpenBSD/8.0"
+MIRROR_FALLBACK="https://cdn.openbsd.org/pub/OpenBSD/8.0"
+declare -A WANT
+while read -r f sha; do WANT[$f]=$sha; done < <(grep -E '^  (sys|src)\.tar\.gz' "$REPO/VERSIONS" | awk '{print $1, $2}')
+
+verify() { # file expected-sha
+  local f="$V/$1"
+  [ -s "$f" ] && [ "$(sha256sum "$f" | cut -d' ' -f1)" = "$2" ]
+}
+
+for pair in "sys.tar.gz ${WANT[sys.tar.gz]}" "src.tar.gz ${WANT[src.tar.gz]}"; do
+  set -- $pair; f=$1; sha=$2
+  if verify "$f" "$sha"; then echo "OK   $f (cached, sha matches)"; continue; fi
+  ok=""
+  for base in "$MIRROR_PRIMARY" "$MIRROR_FALLBACK"; do
+    echo "FETCH $f from $base"
+    if curl -fL --retry 3 -sS -o "$V/$f.part" "$base/$f" && [ "$(sha256sum "$V/$f.part" | cut -d' ' -f1)" = "$sha" ]; then
+      mv "$V/$f.part" "$V/$f"; ok=1; break
+    fi
+  done
+  [ -n "$ok" ] || { echo "FAIL $f sha256 mismatch vs $sha (see VERSIONS)"; exit 1; }
+  echo "OK   $f"
+done

scripts/kernel-config.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Configure the Linux 7.3.4 tree for PF-on-Linux VM lab use:
+# defconfig baseline + direct-kernel-boot deps. Idempotent.
+# `kernel-config.sh test` additionally enables DEBUG_KMEMLEAK (soak builds).
+set -euo pipefail
+K="${KERNELDIR:-$(cd "$(dirname "$0")/../../linux_kernel/linux-7.3.4" && pwd)}"
+cd "$K"
+[ -f .config ] || make defconfig
+scripts/config --file .config \
+  --set-val CONFIG_VIRTIO_BLK y \
+  --set-val CONFIG_VIRTIO_PCI y \
+  --set-val CONFIG_VIRTIO_NET y \
+  --set-val CONFIG_EXT4_FS y \
+  --set-val CONFIG_NETFILTER y \
+  --enable  CONFIG_NETFILTER_ADVANCED \
+  --set-val CONFIG_NET_SCHED y \
+  --set-val CONFIG_INET y \
+  --set-val CONFIG_IPV6 y \
+  --set-val CONFIG_SERIAL_8250 y \
+  --enable  CONFIG_SERIAL_8250_CONSOLE
+if [ "${1:-}" = "test" ]; then
+  scripts/config --file .config --set-val CONFIG_DEBUG_INFO y --enable CONFIG_DEBUG_KMEMLEAK
+fi
+make olddefconfig
+echo "--- effective ---"
+grep -E '^(CONFIG_VIRTIO_(BLK|PCI|NET)|CONFIG_EXT4_FS|CONFIG_NETFILTER|CONFIG_NET_SCHED|CONFIG_INET|CONFIG_IPV6|CONFIG_DEBUG_KMEMLEAK)(=| is not)' .config || true

scripts/vendorize.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Stage pristine OpenBSD 8.0 sources used by port tasks into _vendor/upstream.
+# Run after fetch-sources.sh. Output tree is gitignored; IDS.txt records each
+# file's $OpenBSD: tag for rebase forensics.
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+V="$REPO/_vendor/openbsd"; U="$REPO/_vendor/upstream"
+SYS_K=(net/pf.c net/pf_ioctl.c net/pf_norm.c net/pf_if.c net/pf_lb.c net/pf_ruleset.c
+       net/pf_table.c net/pf_osfp.c net/pf_syncookies.c net/pfvar.h net/pfvar_priv.h
+       net/if_pflog.c net/if_pflog.h net/ifq.c net/ifq.h net/hfsc.c net/hfsc.h
+       net/fq_codel.c net/fq_codel.h netinet/ip_divert.c netinet/ip_divert.h
+       net/radix.c net/radix.h net/radix_node.h net/rtable.c net/rtable.h
+       sys/tree.h sys/queue.h sys/param.h sys/hash.h)
+SRC_K=(sbin/pfctl/parse.y sbin/pfctl/pfctl.c sbin/pfctl/pfctl.h sbin/pfctl/pfctl_parser.c
+       sbin/pfctl/pfctl_parser.h sbin/pfctl/pfctl_optimize.c sbin/pfctl/pfctl_print.c
+       sbin/pfctl/pfctl_osfp.c sbin/pfctl/pfctl_queue.c sbin/pfctl/pfctl_radix.c
+       sbin/pfctl/pfctl_table.c sbin/pfctl/pfctl_snmp.c sbin/pfctl/pf_print_state.c
+       sbin/pfctl/pfctl.8 include/net/pfvar.h include/net/if_pflog.h)
+
+rm -rf "$U"; mkdir -p "$U/sys/net" "$U/sys/sys" "$U/sys/netinet" "$U/sbin/pfctl" "$U/include/net"
+for f in "${SYS_K[@]}"; do
+  if ! tar xzf "$V/sys.tar.gz" -C "$U" "./sys/$f" "sys/$f" 2>/dev/null; then
+    echo "WARN: sys/$f not found in 8.0-sys" >&2
+  fi
+done
+for f in "${SRC_K[@]}"; do
+  tar xzf "$V/src.tar.gz" -C "$U" "./$f" "$f" 2>/dev/null || echo "WARN: $f not found in 8.0-src" >&2
+done
+find "$U" -type f \( -name '*.c' -o -name '*.h' -o -name '*.y' -o -name '*.8' \) | sort | while read -r p; do
+  tag=$(grep -m1 -oE '\$OpenBSD: [^$]*\$' "$p" | head -1 | sed 's/\$OpenBSD: //;s/ \$//')
+  echo "${p#$U/} :: ${tag:-NO-ID}"
+done > "$U/IDS.txt"
+n=$(find "$U" -type f \( -name '*.c' -o -name '*.h' -o -name '*.y' \) | wc -l)
+echo "staged $n files -> $U (IDS.txt)"
+[ "$n" -ge 30 ]