introduce a stable NTL_DDK driver ABI to replace direct HAL_API and kernel-header access in drivers, add code/kernel/io_ddk.c and code/public/ntlite/ddk/ headers, change DriverEntry to take (const NTL_DDK*, NTL_DRIVER_INIT*), update kmain to build the DDK once via IoInitializeDdk/IoGetDdk and hand it to both boot and runtime drivers, downgrade code/public/ntlite/ddi/io_driver.h to a legacy I/O model header pulling from ntlite/ddk instead of kernel internals, move code/third_party/lwip into code/drivers/net/lwip/third_party, fix up lwip_sources.txt and build.c include paths to match, split build.c's single CFLAGS macro into COMMON/KERNEL/USER/BOOT/DRIVER cflags.

code/public/ntlite/ddk/irql.h

@@ -0,0 +1,35 @@
+// Public nt-lite DDK IRQL declarations.
+
+#pragma once
+
+#include <stdint.h>
+
+// Interrupt request level value used by DDK synchronization and IRP state.
+typedef uint8_t KIRQL;
+
+#define PASSIVE_LEVEL   ((KIRQL)0)
+#define APC_LEVEL       ((KIRQL)1)
+#define DISPATCH_LEVEL  ((KIRQL)2)
+#define DIRQL_BASE      ((KIRQL)16)
+#define HIGH_LEVEL      ((KIRQL)31)
+
+// Returns the current processor's software IRQL.
+__declspec(dllexport) KIRQL KeGetCurrentIrql(void);
+
+// Raises to newIrql and returns the previous level.
+__declspec(dllexport) KIRQL KeRaiseIrql(KIRQL newIrql);
+
+// Restores a previously returned level.
+__declspec(dllexport) void KeLowerIrql(KIRQL oldIrql);
+
+// Asserts that the current IRQL exactly matches expected.
+__declspec(dllexport) void KeAssertIrql(KIRQL expected);
+
+// Asserts that the current IRQL is at or below maxIrql.
+__declspec(dllexport) void KeAssertIrqlAtOrBelow(KIRQL maxIrql);
+
+// Returns nonzero when the current context may block.
+__declspec(dllexport) int KeCanWait(void);
+
+// Returns a diagnostic name for an IRQL.
+__declspec(dllexport) const char* KeIrqlName(KIRQL irql);