009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-sideload-system-updates.md

@@ -3,9 +3,12 @@
 Owner cadence: refresh bundled **system / privileged** packages about every
 **2–3 months** without a full ROM reflash. **No** AXP OTA / external repos.
 
-Status: **stub** — fill before final ship (task T046a). Packaging of the
+Status: **stub** — fill before claiming FR-019 done. Packaging of the
 shipping image MUST already preserve update eligibility.
 
+**Full ROM updates** (new LOS base + rebacon) are a different path: recovery
+sideload of the project zip. See [`009-upstream-rebase-ota.md`](009-upstream-rebase-ota.md).
+
 ## In scope
 
 | Component | Intended update path | Signing constraint |