009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/README.md

@@ -0,0 +1,32 @@
+# Build / host scripts
+
+**OTA / rebuild from LOS (use this):**  
+`009-rebuild-from-los.sh`
+
+Always includes wave 4 deblob + hardened_malloc + Magisk release-keys bacon.
+Optional `LOS_SYNC=1` runs `repo sync` first. Run on `rom-dev01` via `rom-detach`.
+
+**Laptop → host stage (OTA inputs only):**
+
+- `009-sync-ota-stage-to-host.sh` — rsync project tree to
+  `/srv/rom/artifacts/009-axp-los23-port/worktree-*` on `rom-dev01`
+- `009-relaunch-polish-bacon.sh` — sync + detached `009-rebuild-from-los.sh`
+  (default session `bacon009polish20261016`, `LOS_DATE=20261016`)
+
+Low-level pieces (called by the rebuild script, not a full OTA by themselves):
+
+- `009-bacon-hardened-malloc.sh` — malloc link check, then ship bacon with wave 4
+- `009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh` — kernel pack + userspace applies + `mka bacon`
+- `009-bacon-wave4-deblob.sh` — wave 4 only (no malloc; not an OTA)
+
+Checklist: `docs/009-upstream-rebase-ota.md`
+
+**Historical / bisect only** (do not use for routine ship):  
+`009-bacon-axp-stage1-combo4*.sh` without `releasekeys`, `009-wait-flash-*`,
+`009-watch-then-cve-bacon.sh`, `009-build-fortify-*`, `009-bisect-*`,
+`009-fortify-select-family.py`.
+
+LAB helpers: `009-diff-yuh-golden-lab.sh`, `009-read-swissquote-rasp.py`,
+`check-module-abi.py` (KernelSU module ABI).
+
+All heavy builds run on `rom-dev01` via `rom-detach` — see `AGENTS.md`.