009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/009-diff-yuh-golden-lab.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Read-only Yuh / banking surface diff: GOLDEN oracle vs LAB.
+# Requires: adb, both devices authorized, root shell (Magisk su).
+set -euo pipefail
+
+GOLDEN=11071JEC203839
+LAB=11231JEC207477
+PKG=com.yuh
+USER_ISLAND=10
+
+section() { echo; echo "======== $1 ========"; }
+
+dump_device() {
+  local tag=$1 serial=$2
+  section "$tag ($serial)"
+  adb -s "$serial" shell true >/dev/null 2>&1 || {
+    echo "adb not ready for $serial"
+    return 1
+  }
+
+  adb -s "$serial" shell "su -c '
+    echo --- build ---
+    getprop ro.build.display.id
+    getprop ro.build.version.release
+    getprop ro.build.version.sdk
+    echo --- magisk ---
+    magisk -v 2>/dev/null || true
+    magisk --sqlite \"SELECT key,value FROM settings\" 2>/dev/null | sort
+    echo --- modules (no disable) ---
+    for d in /data/adb/modules/*; do
+      [ -d \"\$d\" ] || continue
+      name=\$(basename \"\$d\")
+      [ -f \"\$d/disable\" ] && state=DISABLED || state=active
+      id=
+      [ -f \"\$d/module.prop\" ] && id=\$(grep -E ^id= \"\$d/module.prop\" | cut -d= -f2)
+      echo \"\$state \$name id=\$id\"
+    done
+    echo --- tricky_store targets ---
+    if [ -f /data/adb/tricky_store/target.txt ]; then
+      cat /data/adb/tricky_store/target.txt
+    else
+      echo missing target.txt
+    fi
+    echo --- denylist (yuh / swissquote) ---
+    magisk --denylist ls 2>/dev/null | grep -E \"yuh|swissquote\" || true
+    echo --- boot props (app-visible) ---
+    getprop ro.boot.verifiedbootstate
+    getprop ro.boot.flash.locked
+    getprop ro.boot.vbmeta.device_state
+    getprop ro.boot.veritymode
+    getprop sys.oem_unlock_allowed
+    echo --- cmdline mode ---
+    ls -l /proc/cmdline
+    echo --- yuh packages ---
+    pm list packages --user 0 \"$PKG\" 2>/dev/null || true
+    pm list packages --user $USER_ISLAND \"$PKG\" 2>/dev/null || true
+    dumpsys package \"$PKG\" 2>/dev/null | grep -E \"versionName|versionCode|firstInstallTime|installerPackage\" | head -20
+    echo --- island ---
+    pm list packages --user $USER_ISLAND com.oasisfeng.island.fdroid 2>/dev/null | head -1
+    dumpsys package com.oasisfeng.island.fdroid 2>/dev/null | grep versionName | head -1
+    echo --- vector props log (tail) ---
+    if [ -f /data/adb/lspd/log/props.txt ]; then
+      tail -30 /data/adb/lspd/log/props.txt
+    else
+      echo no props.txt
+    fi
+  '" 2>&1 | sed 's/\r$//'
+}
+
+dump_device GOLDEN "$GOLDEN" || true
+dump_device LAB "$LAB" || true
+
+section "Next: Yuh open in Island user $USER_ISLAND on LAB only"
+echo "  adb -s $LAB logcat -c"
+echo "  # open Yuh in Island, reproduce fail"
+echo "  adb -s $LAB logcat -d | grep -iE 'yuh|talsec|keystore2|KeyMint|integrity|DroidGuard|vectord|teesim' | tail -80"