009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-hardening-signing-checklist.md

@@ -1,17 +1,21 @@
 # 009 — Userspace hardening / signing / AVB checklist (Gate G)
 
+> **Closure measured 2026-10-09:** LAB ship is `user` + `release-keys` + AVB
+> flags 0 + Magisk preroot + malloc. Prefer
+> [`009-closure-parity-20261009.md`](009-closure-parity-20261009.md) over the
+> 2026-09-29 baseline table below (kept for archaeology).
+
 **Task:** T040.  
 **Companion:** kernel half = `docs/009-gate-g-kernel-attribution.md`.  
-**Policy (2026-09-29):** project **release keys yes**; **bootloader relock no**
-(AXP/LOS unlocked norm; IOdes-class lock = non-goal). See
-`specs/009-axp-los23-port/research.md`.
+**Policy:** project **release keys yes**; **bootloader relock no**
+(AXP/LOS unlocked norm). See `specs/009-axp-los23-port/research.md`.
 
 Secrets never enter Git. Host material lives under `/srv/rom/secrets/` on
 `rom-dev01` only.
 
 ---
 
-## Measured baseline (2026-09-29)
+## Measured baseline (2026-09-29 — historical)
 
 | Prop / fact | GOLDEN (AXP Pro) | LAB (Stage1 pack) | Target |
 |-------------|------------------|-------------------|--------|
@@ -193,7 +197,7 @@ See `docs/009-us-s4-userspace-hardening.md`.
 | Candidate | Priority | Notes |
 |-----------|----------|-------|
 | Confirm SELinux Enforcing + encryption | **done** | LAB Enforcing + FBE |
-| ptrace/Yama | **done US-S5-1** | LAB `162840Z` `CONFIG_SECURITY_YAMA=y` |
+| ptrace/Yama | **reverted 2026-10-10** | Yama off like GOLDEN; scope 2 broke PairIP (Wallapop) |
 | Debug/bugreport surface trim | **done US-S4-1** | AXP PRO product oracle |
 | Jelly + Gallery2 debloat | **US-S4-2 wired** | AXP PRO product; Fossify kept |
 | mount flags / noexec where stock allows | early | don't break HW |
@@ -208,7 +212,7 @@ attribution. One stage per bacon when risk is unclear.
 **Do not** flash old `20260918*-axp-kh-cve` / `kh-full` (logo hang).
 
 - [x] CVE clean-offset 429 + hi-batch1–3 on Magisk ship (`151944Z` LAB OK)
-- [x] **US-S5-1** LAB OK (`162840Z`): `CONFIG_SECURITY_YAMA=y` +
+- [x] **US-S5-1** LAB OK (`162840Z`): Yama since reverted to unset (PairIP) +
       `CONFIG_SLAB_FREELIST_RANDOM=y` — see
       `docs/009-lab-acceptance-20261002-uss5.md`
 - [ ] **Next cycle after the user image is accepted** (owner 2026-10-06):