009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

AGENTS.md

@@ -18,9 +18,11 @@ unless the owner explicitly asks.
 
 ## Sources of truth
 
-Resume point for the unfinished ROM (2026-10-08): `docs/009-handoff-20261008.md`.
-Read that before the older remaining-work docs; several of those still describe
-pre-boot state.
+Resume point: `docs/009-handoff-20261008.md` (closure
+`docs/009-closure-parity-20261009.md`). Doc index: `docs/README.md`.
+Next LOS sync / first project OTA zip: `docs/009-upstream-rebase-ota.md`.
+Read the handoff before older remaining-work docs; many fortify/CVE/`007`
+files are historical only (`docs/archive/README.md`).
 
 1. **Constitution** (`.specify/memory/constitution.md`) — global project rules
    for this Magisk-resurrection track.
@@ -45,7 +47,9 @@ This track is an **AXP.OS → LOS23/A16** resurrection (~clone). Default method:
 
 Do **not** redesign Magisk, microG, Phonesky, DNS, connectivity, hardening
 package sets, or other AXP-class features “our way” for convenience.
-KernelSU/SusFS (`007`) stays **standby** — never mix into Magisk ship boots.
+KernelSU / ReSukiSU / SusFS (`007`) is a **parallel** track (boot worked; keep
+all docs). Never mix into Magisk ship bacons. Retry on current ROM:
+`docs/007-parallel-on-009.md`.
 
 Magisk specifically: EXTENDROM `EXTENDROM_PREROOT_BOOT` (boot patch, Magisk
 **not** a `PRODUCT_PACKAGE`, dormant until Additional Setup). See