M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

module/include/compat/sys/refcnt.h

@@ -0,0 +1,38 @@
+/* PFLINUX compat: <sys/refcnt.h> — refcount_t wrapper with OpenBSD API */
+#ifndef _PFK_REFCNT_H
+#define _PFK_REFCNT_H
+#include <linux/refcount.h>
+
+struct refcnt { refcount_t rc; };
+#define REFCNT_INITIALIZER	{ .rc = REFCNT_INIT }
+
+static inline void refcnt_init(struct refcnt *r, unsigned int v)
+{
+	refcount_set(&r->rc, v ? (int)v : 1);
+}
+static inline unsigned int refcnt_value(const struct refcnt *r)
+{
+	return refcount_read((refcount_t *)&r->rc);
+}
+static inline void refcnt_take(struct refcnt *r)
+{
+	refcount_inc(&r->rc);
+}
+/* returns true if ref was valid and taken (OpenBSD refcnt_take_if) */
+static inline bool refcnt_take_not0(struct refcnt *r)
+{
+	return refcount_inc_not_zero(&r->rc);
+}
+static inline unsigned int refcnt_rele(struct refcnt *r)
+{
+	return (unsigned int)refcount_dec_and_test(&r->rc) ?
+		refcnt_value(r) : refcnt_value(r) + 1;
+}
+static inline unsigned int refcnt_rele_wake(struct refcnt *r)
+{
+	return refcnt_rele(r);
+}
+static inline void refcnt_finalize(struct refcnt *r, const void *unused)
+{
+}
+#endif