M1: compat layer + pf.ko skeleton builds against Linux 7.3.4

- pfk.h: BSD types/ioctl encoding (OpenBSD bit layout), locks (NET_LOCK=rwsem),
  pools, timeouts, mbuf shim over sk_buff, ifnet registry, toeplitz/siphash
- pfk_mod/pfk_hooks: misc /dev/pf (0600), IPv4 netfilter hook skeleton,
  DIOCGETSTATUS answered (M1 skeleton; engine ioctls land with pf_ioctl.c)
- vendorize/stage-port scripts: deterministic upstream staging with seds
  (struct renames, IFF_*->PFIFF_*, sa_len drops) logged to docs/porting-notes
- fixes: modules_prepare+Module.symvers for out-of-tree builds

scripts/build-module.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# Build pf.ko out-of-tree against the patched kernel tree.
+set -euo pipefail
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+K="${KERNELDIR:-$(cd "$REPO/../linux-7.3.4" && pwd)}"
+[ -e "$K/Module.symvers" ] || {
+  if [ -f "$K/vmlinux.symvers" ]; then cp "$K/vmlinux.symvers" "$K/Module.symvers";
+  else echo "kernel tree not prepared — run scripts/build-kernel.sh first" >&2; exit 1; fi; }
+[ -f "$K/scripts/module.lds" ] || make -C "$K" -j4 modules_prepare >/dev/null
+make -C "$K" M="$REPO/module" "$@"
+echo MODULE_BUILD_OK