AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.

vendor/sunfish-a16/gms.mk

@@ -0,0 +1,25 @@
+# sunfish-a16-rom — microG + GSF + patched Phonesky (feature 004)
+# Layout mirrors AXP GOLDEN: Phonesky→system priv-app; GmsCore/Gsf→system_ext app.
+# No FakeStore. APKs are PRESIGNED prebuilts (not in Git meta-repo).
+
+PRODUCT_PACKAGES += \
+    GmsCore \
+    GsfProxy \
+    Phonesky
+
+# A16 / generic_system artifact rules forbid device-specific files on system
+# unless allow-listed. Keep AXP GOLDEN paths (system priv-app + XMLs) via allow-list
+# rather than moving Phonesky to product.
+PRODUCT_ARTIFACT_PATH_REQUIREMENT_ALLOWED_LIST += \
+    system/priv-app/Phonesky/Phonesky.apk \
+    system/etc/permissions/com.android.vending.xml \
+    system/etc/permissions/privapp-permissions-com.android.vending.xml \
+    system/etc/default-permissions/phonesky-permissions.xml
+
+# Phonesky only — AXP GOLDEN ships these with system priv-app Phonesky.
+# microG on GOLDEN is system_ext *app* (not priv-app): do not invent
+# privapp-permissions for GmsCore until Self-Check proves A16 needs them.
+PRODUCT_COPY_FILES += \
+    vendor/sunfish-a16/permissions/privapp-permissions-com.android.vending.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/permissions/privapp-permissions-com.android.vending.xml \
+    vendor/sunfish-a16/permissions/com.android.vending.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/permissions/com.android.vending.xml \
+    vendor/sunfish-a16/default-permissions/phonesky-permissions.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/default-permissions/phonesky-permissions.xml