009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/001-host-runbook.md

@@ -153,7 +153,7 @@ Independent of SSYSTEMS Salt/GitLab. All on `rom-dev01`.
   `/srv/rom/secrets/semaphore-admin.txt`
 - Admin user (both apps): `sunfish-admin` (after nginx Basic)
 - Git transport: **HTTPS via nginx** (Gitea still `DISABLE_SSH=true`; no public `:2222`)
-- Repos (private): `sunfish-admin/{sunfish-a16-rom,sunfish-rom-manifest,sunfish-rom-build,sunfish-rom-patches}`
+- Repos (private): `sunfish-admin/{AXP-Resurection,sunfish-a16-rom,sunfish-rom-manifest,sunfish-rom-build,sunfish-rom-patches}`
 - Automation tree: `/home/android-build/sunfish-rom-build` (not inside Spec Kit meta)
 - Semaphore project `sunfish-rom` template `env-smoke` clones **canonical**
   `sunfish-rom-build` from Gitea and runs `ansible/smoke.yml` unprivileged