M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

lab/cloud-init/meta-data.tmpl

@@ -0,0 +1,2 @@
+instance-id: pflab-@VM@-v3
+local-hostname: @VM@

lab/cloud-init/network-config.cli.tmpl

@@ -0,0 +1,14 @@
+# cloud-init network config v2 — pftest-cli. mgmt dhcp gives DNS only
+# (use-routes:false); default route goes through pf0 so LAN->WAN traffic
+# exercises pf forwarding. Rendered by scripts/vm-create.sh.
+version: 2
+ethernets:
+  mgmt:
+    match: {macaddress: "@CLI_MAC_MGMT@"}
+    dhcp4: true
+    dhcp4-overrides: {use-routes: false}
+  lan:
+    match: {macaddress: "@CLI_MAC_LAN@"}
+    addresses: [@CLI@]
+    routes:
+      - {to: default, via: @CLI_GW@}

lab/cloud-init/network-config.gw2.tmpl

@@ -0,0 +1,13 @@
+# cloud-init network config v2 — pftest-gw2. No mgmt NIC (contract):
+# pf-wan2 + pf-wan only, forwards between them (ip_forward set in user-data);
+# default via pf0 so the guest itself has egress for package installs.
+version: 2
+ethernets:
+  wan2:
+    match: {macaddress: "@GW2_MAC_WAN2@"}
+    addresses: [@GW2_WAN2@]
+  wan:
+    match: {macaddress: "@GW2_MAC_WAN@"}
+    addresses: [@GW2_WAN@]
+    routes:
+      - {to: default, via: @PF0_WAN_IP@}

lab/cloud-init/network-config.pf0.tmpl

@@ -0,0 +1,16 @@
+# cloud-init network config v2 — pftest-pf0. mgmt=dhcp on default net,
+# data ifaces static (lab/ips.env). Rendered by scripts/vm-create.sh.
+version: 2
+ethernets:
+  mgmt:
+    match: {macaddress: "@PF0_MAC_MGMT@"}
+    dhcp4: true
+  lan:
+    match: {macaddress: "@PF0_MAC_LAN@"}
+    addresses: [@PF0_LAN@]
+  wan:
+    match: {macaddress: "@PF0_MAC_WAN@"}
+    addresses: [@PF0_WAN@]
+  wan2:
+    match: {macaddress: "@PF0_MAC_WAN2@"}
+    addresses: [@PF0_WAN2@]

lab/cloud-init/network-config.srv.tmpl

@@ -0,0 +1,15 @@
+# cloud-init network config v2 — pftest-srv. mgmt dhcp gives DNS only;
+# default via pf0 (SRV_GW); 10.0.3.0/24 pinned via gw2 so the srv->gw2
+# path is exercised through gw forwarding instead of pf0's own link.
+version: 2
+ethernets:
+  mgmt:
+    match: {macaddress: "@SRV_MAC_MGMT@"}
+    dhcp4: true
+    dhcp4-overrides: {use-routes: false}
+  wan:
+    match: {macaddress: "@SRV_MAC_WAN@"}
+    addresses: [@SRV@]
+    routes:
+      - {to: default, via: @SRV_GW@}
+      - {to: 10.0.3.0/24, via: @GW2_WAN_IP@}

lab/cloud-init/user-data.tmpl

@@ -0,0 +1,23 @@
+#cloud-config
+# Rendered per VM by scripts/vm-create.sh (tokens: @...@).
+hostname: @VM@
+manage_etc_hosts: true
+ssh_pwauth: true
+users:
+  - name: root
+    lock_passwd: false
+    ssh_authorized_keys:
+      - @SSH_PUBKEY@
+chpasswd:
+  expire: false
+  users:
+    - name: root
+      password: "@ROOT_PASS@"
+      type: text
+packages: @LAB_PACKAGES@
+runcmd:
+  - echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/00-pflab.conf
+  - sysctl -q -p /etc/sysctl.d/00-pflab.conf
+  - "printf '@ROOT_PASS@\\n@ROOT_PASS@\\n' | passwd root >/dev/null 2>&1 || true"
+@RUNCMD_EXTRA@
+  - touch /run/pf-lab-ready