introduce a stable NTL_DDK driver ABI to replace direct HAL_API and kernel-header access in drivers, add code/kernel/io_ddk.c and code/public/ntlite/ddk/ headers, change DriverEntry to take (const NTL_DDK*, NTL_DRIVER_INIT*), update kmain to build the DDK once via IoInitializeDdk/IoGetDdk and hand it to both boot and runtime drivers, downgrade code/public/ntlite/ddi/io_driver.h to a legacy I/O model header pulling from ntlite/ddk instead of kernel internals, move code/third_party/lwip into code/drivers/net/lwip/third_party, fix up lwip_sources.txt and build.c include paths to match, split build.c's single CFLAGS macro into COMMON/KERNEL/USER/BOOT/DRIVER cflags.

code/public/ntlite/ddk/thread.h

@@ -0,0 +1,34 @@
+// Public nt-lite DDK system-thread declarations.
+
+#pragma once
+
+#include <stdint.h>
+#include <ntlite/status.h>
+
+typedef struct THREAD THREAD;
+
+#ifndef NTL_THREAD_PRIORITY_DEFINED
+typedef enum THREAD_PRIORITY {
+    PriorityLow = 0,
+    PriorityNormal = 1,
+    PriorityHigh = 2,
+    PriorityCount = 3,
+} THREAD_PRIORITY;
+#define NTL_THREAD_PRIORITY_DEFINED 1
+#endif
+
+// Creates a system-process kernel thread for a kernel-mode driver.
+__declspec(dllexport) KSTATUS KeCreateKernelThread(uintptr_t fn,
+                                                   uintptr_t arg,
+                                                   THREAD_PRIORITY priority,
+                                                   THREAD** out);
+
+// Creates a system-process kernel thread with an explicit affinity mask.
+__declspec(dllexport) KSTATUS KeCreateKernelThreadWithAffinity(uintptr_t fn,
+                                                               uintptr_t arg,
+                                                               THREAD_PRIORITY priority,
+                                                               uint64_t affinityMask,
+                                                               THREAD** out);
+
+// Yields the current processor to another runnable thread.
+__declspec(dllexport) void KeYield(void);