009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-gate-g-kernel-attribution.md

@@ -1,5 +1,10 @@
 # Gate G / FR-017 — kernel hardening attribution (ship candidate)
 
+> **Measured LAB closure (2026-10-09):** `user` + `release-keys` + Magisk 30.7
+> pack — see [`009-closure-parity-20261009.md`](009-closure-parity-20261009.md).
+> Tables below that still say Oct-1 / “userspace Gate G open / test-keys” are
+> **historical acceptance**; prefer closure for current props.
+
 **What “Gate G doc” means:** the acceptance contract asks for a written list of
 **what kernel hardening we applied, what we skipped and why**, plus userspace
 AVB/signing gaps (or “impossible on this stack”). This file is that list for the