009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-us-s4-userspace-hardening.md

@@ -12,7 +12,7 @@ On LAB `11231JEC207477` after AVB ship `20261002T103558Z` (+ boot/vbmeta reinfor
 | Encryption | `ro.crypto.state=encrypted`, `ro.crypto.type=file` |
 | Verified boot | orange / `flash.locked=0` (unlocked Magisk track) |
 | `security.perf_harden` | 1 (already) |
-| Yama / `ptrace_scope` | **done** (US-S5-1 `162840Z`) — `CONFIG_SECURITY_YAMA=y` |
+| Yama / `ptrace_scope` | **off like GOLDEN** (reverted 2026-10-10: scope 2 broke PairIP) |
 
 ## Stage 1 — US-S4-1 drop product OpenSSH / rsync / procmem