M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

lab/cloud-init/network-config.srv.tmpl

@@ -0,0 +1,15 @@
+# cloud-init network config v2 — pftest-srv. mgmt dhcp gives DNS only;
+# default via pf0 (SRV_GW); 10.0.3.0/24 pinned via gw2 so the srv->gw2
+# path is exercised through gw forwarding instead of pf0's own link.
+version: 2
+ethernets:
+  mgmt:
+    match: {macaddress: "@SRV_MAC_MGMT@"}
+    dhcp4: true
+    dhcp4-overrides: {use-routes: false}
+  wan:
+    match: {macaddress: "@SRV_MAC_WAN@"}
+    addresses: [@SRV@]
+    routes:
+      - {to: default, via: @SRV_GW@}
+      - {to: 10.0.3.0/24, via: @GW2_WAN_IP@}