M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

lab/ips.env

@@ -0,0 +1,68 @@
+# PF-on-Linux VM lab topology — single source of truth.
+# Consumed by scripts/lab-lib.sh (sourced as shell). VM aliases: pf0 cli srv gw2
+# (domain names are pftest-<alias>). Hypervisor host "deb" runs everything.
+
+DEB=192.168.1.242
+DEB_USER=root
+
+# --- addressing (contract) ---
+PF0_MGMT=dhcp                      # default-net NAT 192.168.122.0/24 (dhcp)
+PF0_LAN=10.0.1.1/24
+PF0_WAN=10.0.2.1/24
+PF0_WAN2=10.0.3.1/24
+CLI=10.0.1.10/24
+CLI_GW=10.0.1.1
+SRV=10.0.2.20/24
+SRV_GW=10.0.2.1
+GW2_WAN2=10.0.3.2/24
+GW2_WAN=10.0.2.2/24                # gw2 ip_forward=1 forwards wan2<->wan
+
+# IPs that laptop `ssh pf0|cli|srv|gw2` (ProxyJump via deb) and nested ssh use.
+PF0_SSH=10.0.1.1
+CLI_SSH=10.0.1.10
+SRV_SSH=10.0.2.20
+GW2_SSH=10.0.3.2                   # reachable from deb via pf-wan2 bridge IP
+
+# --- libvirt networks ---
+MGMT_NET=default                   # start+autostart; NAT, dhcp
+NET_PF_LAN=pf-lan                  # 10.0.1.0/24, forward=none
+NET_PF_WAN=pf-wan
+NET_PF_WAN2=pf-wan2
+# Host-side bridge addresses (NOT used by any guest; let deb route to VMs).
+PF_LAN_HOSTIP=10.0.1.254
+PF_WAN_HOSTIP=10.0.2.254
+PF_WAN2_HOSTIP=10.0.3.254
+PF_NET_PREFIX=255.255.255.0
+
+# --- domain sizing ---
+VM_VCPUS=2
+VM_MEM_MB=1024
+
+# --- MACs (match blocks in network-config templates) ---
+PF0_MAC_MGMT=52:54:00:aa:00:01
+PF0_MAC_LAN=52:54:00:aa:00:02
+PF0_MAC_WAN=52:54:00:aa:00:03
+PF0_MAC_WAN2=52:54:00:aa:00:04
+CLI_MAC_MGMT=52:54:00:bb:00:01
+CLI_MAC_LAN=52:54:00:bb:00:02
+SRV_MAC_MGMT=52:54:00:cc:00:01
+SRV_MAC_WAN=52:54:00:cc:00:02
+GW2_MAC_WAN=52:54:00:dd:00:01
+GW2_MAC_WAN2=52:54:00:dd:00:02
+
+# --- root creds / packages (cloud-init) ---
+ROOT_PASS=pftest
+LAB_PACKAGES='[iperf3, tcpdump, python3, py3-scapy, bash]'
+
+# --- paths ---
+IMG_DIR=/var/lib/libvirt/images
+BASE_IMG=$IMG_DIR/alpine-base.qcow2           # immutable; per-VM disks back onto it
+SEED_DIR=/var/lib/libvirt/pflab/seeds         # cloud-init dirs + seed.iso per VM
+DEPLOY_DIR=/var/lib/pflab/deploy              # vm-deploy.sh landing zone (on deb)
+BOOT_DIR=/var/lib/pflab/boot                  # --pf0-kernel artifacts (on deb)
+LAB_KEY_DEB=/root/.ssh/pflab_ed               # keypair injected into VM authorized_keys
+LAB_KEY_LAPTOP=$HOME/.ssh/pflab_ed
+LAPTOP_SSH_FRAG=$HOME/.ssh/config.d/pflab
+
+# Laptop source image fetched by scripts/fetch-sources.sh (see vendorize.sh style).
+BASE_SRC_REL=_vendor/images/alpine-3.22-x86_64-cloud.qcow2