M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

module/Makefile

@@ -0,0 +1,17 @@
+# PF-on-Linux kernel module build (out-of-tree)
+# Build:  make -C /path/to/linux-7.3.4 M=$PWD   (or scripts/build-module.sh)
+ccflags-y := -I$(src)/include -I$(src)/include/compat -DPFLINUX=1 \
+             -Wno-declaration-after-statement
+
+# M1 skeleton set — staged engine files (pf.c, pf_ioctl.c, ...) are added
+# per plan tasks T7b/T10/T11/T12; keep list explicit (no wildcards).
+pf-objs := pfsrc/pfk_mod.o pfsrc/pfk_hooks.o \
+           compat/pfk_mbuf.o compat/pfk_kern.o compat/pfk_if.o compat/pfk_xmit.o \
+           compat/siphash.o compat/toeplitz.o
+# staged BSD sources (uncomment as ported):
+# pf-objs += compat/sha2.o compat/sha1.o compat/siphash.o compat/toeplitz.o
+# pf-objs += compat/radix.o compat/rtable.o
+# pf-objs += pfsrc/pf.o pfsrc/pf_ioctl.o pfsrc/pf_norm.o pfsrc/pf_if.o pfsrc/pf_lb.o
+# pf-objs += pfsrc/pf_ruleset.o pfsrc/pf_table.o pfsrc/pf_osfp.o pfsrc/pf_syncookies.o
+
+obj-m := pf.o