M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

lab/cloud-init/user-data.tmpl

@@ -0,0 +1,23 @@
+#cloud-config
+# Rendered per VM by scripts/vm-create.sh (tokens: @...@).
+hostname: @VM@
+manage_etc_hosts: true
+ssh_pwauth: true
+users:
+  - name: root
+    lock_passwd: false
+    ssh_authorized_keys:
+      - @SSH_PUBKEY@
+chpasswd:
+  expire: false
+  users:
+    - name: root
+      password: "@ROOT_PASS@"
+      type: text
+packages: @LAB_PACKAGES@
+runcmd:
+  - echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/00-pflab.conf
+  - sysctl -q -p /etc/sysctl.d/00-pflab.conf
+  - "printf '@ROOT_PASS@\\n@ROOT_PASS@\\n' | passwd root >/dev/null 2>&1 || true"
+@RUNCMD_EXTRA@
+  - touch /run/pf-lab-ready