009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/009-axp-los23-port/README.md

@@ -14,8 +14,9 @@
 4. **Magisk preroot** — EXTENDROM-class boot/`init_boot` patch using Magisk APK
    from `/srv/rom/prebuilts/magisk/` (see `docs/009-magisk-preinstall-runbook.md`).
    Stub: `vendor/sunfish-a16/magisk.mk`. Attribute: Magisk upstream + sfX
-   extendrom Magisk patcher. **Host tree currently has no `vendor/extendrom`**
-   — must vendor minimal patcher or checkout extendrom before first Magisk bacon.
+   extendrom Magisk patcher. **Shipped on LAB (2026-10):** Magisk 30.7 preroot
+   via host EXTENDROM at `/srv/rom/references/extendrom/` (wired by the ship
+   bacon). Do not treat the old “blocked on T011” note as current.
 5. **Bundled apps** — `/srv/rom/prebuilts/axp-apps/` + `apps.mk` (Aurora,
    Droidify, Fossify Gallery). Symlink APKs into `vendor/sunfish-a16/prebuilt/`.
 6. **Private DNS presets** — `apply_009_private_dns_providers.py` (GOLDEN list).
@@ -31,6 +32,10 @@
    `vendor/sunfish-a16/patches/009-kernel-hardening/apply_stage1.sh`
    (AXP Graphene/AH allowlist). Priority: AXP → LOS → Iodé → optional
    Graphene; no Divest hunt; no extra location lockdown.
+11. **2026-10-16 polish** (ship bacon) — `apply_009_euicc_disabler_guard.py`,
+    `apply_009_thermal_cdev_log.py`; wave4
+    `apply_009_drop_lab_only_commands.py` must **keep/restore**
+    `disable_configstore`. Details: `docs/009-lab-polish-20261016.md`.
 
 ## Product includes
 
@@ -54,5 +59,7 @@ Wire Magisk-resurrection product from `vendor/sunfish-a16/` into
 | Vanilla baseline | `/srv/rom/artifacts/003-vanilla/20260914-lineage-23.2-sunfish/` |
 | Optional KSU boots | `/srv/rom/artifacts/007-kernelsu/` (non-ship) |
 
-**Gap:** `vendor/extendrom` is **not** checked out in the lineage tree yet.
-Magisk bacon blocked on T011 (symlink/checkout + PREROOT or slim wire).
+**Host wiring (current):** EXTENDROM Magisk patcher lives under
+`/srv/rom/references/extendrom/` and is invoked by
+`scripts/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh`. Magisk APK pin:
+`/srv/rom/prebuilts/magisk/Magisk-v30.7.apk`.