009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh

@@ -1,10 +1,12 @@
 #!/bin/bash
-# US-S5-1 — enable remaining Graphene/AXP-class defconfig knobs on msm-4.14.
+# US-S5-1 — remaining Graphene/AXP-class defconfig knobs on msm-4.14.
 #
-# Oracle: AXP/Graphene kernel hardening expects Yama + slab freelist random
-# (combo4 already ships SLAB_FREELIST_HARDENED). LOS sunfish_defconfig left both
-# off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
-# never built.
+# SLAB_FREELIST_RANDOM: LOS sunfish_defconfig leaves it off (combo4 already
+# ships SLAB_FREELIST_HARDENED).
+#
+# SECURITY_YAMA: GOLDEN's running 4.14.355 config leaves it unset, so AXP's
+# init ptrace_scope writes are inert there. With Yama built, scope 2 denies
+# PairIP's self-ptrace (Wallapop SIGSEGV, LAB 2026-10-10). Match GOLDEN.
 #
 # Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped).
 # CVE-2022-49980's one-liner stays on the denylist. The bacon applies
@@ -20,16 +22,15 @@ set -euo pipefail
 K=${1:?kernel tree}
 DEF="$K/arch/arm64/configs/sunfish_defconfig"
 test -f "$DEF"
-test -f "$K/security/yama/Kconfig"
 
 for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR; do
   sed -i "/CONFIG_${k}/d" "$DEF"
 done
 
 {
-  echo "CONFIG_SECURITY_YAMA=y"
+  echo "# CONFIG_SECURITY_YAMA is not set"
   echo "CONFIG_SLAB_FREELIST_RANDOM=y"
   echo "# CONFIG_USERFAULTFD is not set"
 } >> "$DEF"
 
-echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM, USERFAULTFD off) on $K"
+echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; YAMA, USERFAULTFD off) on $K"

vendor/sunfish-a16/patches/009-kernel-hardening/uss5-1-README.md

@@ -1,4 +1,4 @@
-# US-S5-1 — Yama + SLAB freelist random (defconfig)
+# US-S5-1 — SLAB freelist random (defconfig); Yama off like GOLDEN
 
 **Track**: AXP Resurection Pro Magisk, unlocked sunfish.  
 **On top of**: Stage1 + combo4 + FORTIFY + CVE clean-429 + hi-batch1–3.
@@ -12,9 +12,17 @@ quarantine:
 
 | Knob | Before | After | Attribution |
 |------|--------|-------|-------------|
-| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | `=y` | Graphene/AXP LSM stack; ptrace scope |
+| `CONFIG_SECURITY_YAMA` | unset (but `CONFIG_LSM` listed yama) | unset | GOLDEN 4.14.355 config: not set |
 | `CONFIG_SLAB_FREELIST_RANDOM` | unset | `=y` | Graphene/AH slab hardening companion to existing `SLAB_FREELIST_HARDENED` |
 
+Yama was `=y` from `162840Z` until 2026-10-10. With `apply_009_yama_ptrace.py`
+init set `ptrace_scope=2`, which denies PairIP's self-ptrace. Wallapop then
+died with SIGSEGV right after `libpairipcore.so` loaded. dmesg showed
+`ptrace attach of "com.wallapop"[…] was attempted by "com.wallapop"[…]`.
+With `persist.native_debug=true` (scope 0), LAB passed PairIP. GOLDEN has no
+Yama, so AXP's init writes are inert there. The AXP init/sepolicy patch stays,
+inert in the same way.
+
 ## Apply
 
 ```bash
@@ -28,17 +36,12 @@ Stage1+combo4+CVE apply.
 ## LAB verify
 
 ```text
-zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
+zcat /proc/config.gz | grep 'CONFIG_SECURITY_YAMA is not set'
 zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
-cat /proc/sys/kernel/yama/ptrace_scope   # expect 2 (ship policy)
+ls /proc/sys/kernel/yama                 # expect: no such file
 pidof magiskd                            # still up
 ```
 
-The ship script now applies `apply_009_yama_ptrace.py`, so the current LAB
-policy is `ptrace_scope=2`, not the kernel default `1`. Matching AXP's
-`persist.native_debug` 0/2 toggle is a separate userspace change and must not
-be mixed into the CVE-2022-49980 boot test.
-
 ## Out of scope here
 
 - The original `CVE-2022-49980/ANY/0001.patch` remains denylisted. The next