009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/009-bacon-hardened-malloc.sh

@@ -1,8 +1,11 @@
 #!/bin/bash
-# 012 bacon: current ship pack plus Graphene hardened_malloc.
-# Compiles libc first. The full bacon runs only if that link succeeds.
-# Does not change AVB flags or run the userspace deblob.
+# Final ship candidate: closure pack + wave 4 deblob + hardened_malloc (2 GiB regions).
+# Compiles libc first; full bacon runs only if that link succeeds.
+# AVB flags 0 (Magisk track). Queue after any in-flight ninja on the same out/.
 set -e
+export AXP_AVB_FLAGS=0
+export WITH_AVB=true
+export AXP_DEBLOB_WAVE4=1
 cd /srv/rom/src/lineage
 export HOME=/home/android-build
 export CCACHE_DIR=/srv/rom/ccache
@@ -26,4 +29,5 @@ breakfast sunfish user
 echo "=== m libc $(date -Is) ==="
 m libc -j8
 echo "=== libc ok, starting bacon $(date -Is) ==="
-exec /srv/rom/artifacts/bin/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh
+# Same tree as this file (do not depend on a stale copy under artifacts/bin).
+exec bash "$(cd "$(dirname "$0")" && pwd)/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh"