M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

module/include/compat/crypto/siphash.h

@@ -0,0 +1,27 @@
+/* PFLINUX compat: <crypto/siphash.h> — SipHash-2-4 (Aumasson–Bernstein)
+ * API compatible with OpenBSD's SIPHASH_CTX/KEY usage in pf_syncookies.c.
+ * Implementation: compat/siphash.c (ISC 2026). */
+#ifndef _PFK_SIPHASH_H
+#define _PFK_SIPHASH_H
+#include <linux/types.h>
+
+#define SIPHASH_KEY_LENGTH   16
+
+typedef struct {
+	__u64 v[2];
+} SIPHASH_KEY;
+
+typedef struct {
+	__u64 v[3];
+	__u64 total_len;
+	unsigned char block[8];
+	unsigned char block_len;
+} SIPHASH_CTX;
+
+void SipHash24_Init(SIPHASH_CTX *ctx, const SIPHASH_KEY *key);
+void SipHash24_Update(SIPHASH_CTX *ctx, const void *in, __u64 inlen);
+void SipHash24_Final(SIPHASH_CTX *ctx, unsigned char *out);
+void SipHash24_Generate(const SIPHASH_KEY *key, const void *in, __u64 inlen,
+	unsigned char *out);
+
+#endif