009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh

@@ -1,10 +1,12 @@
 #!/bin/bash
-# US-S5-1 — enable remaining Graphene/AXP-class defconfig knobs on msm-4.14.
+# US-S5-1 — remaining Graphene/AXP-class defconfig knobs on msm-4.14.
 #
-# Oracle: AXP/Graphene kernel hardening expects Yama + slab freelist random
-# (combo4 already ships SLAB_FREELIST_HARDENED). LOS sunfish_defconfig left both
-# off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
-# never built.
+# SLAB_FREELIST_RANDOM: LOS sunfish_defconfig leaves it off (combo4 already
+# ships SLAB_FREELIST_HARDENED).
+#
+# SECURITY_YAMA: GOLDEN's running 4.14.355 config leaves it unset, so AXP's
+# init ptrace_scope writes are inert there. With Yama built, scope 2 denies
+# PairIP's self-ptrace (Wallapop SIGSEGV, LAB 2026-10-10). Match GOLDEN.
 #
 # Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped).
 # CVE-2022-49980's one-liner stays on the denylist. The bacon applies
@@ -20,16 +22,15 @@ set -euo pipefail
 K=${1:?kernel tree}
 DEF="$K/arch/arm64/configs/sunfish_defconfig"
 test -f "$DEF"
-test -f "$K/security/yama/Kconfig"
 
 for k in SECURITY_YAMA SLAB_FREELIST_RANDOM USERFAULTFD HAVE_ARCH_USERFAULTFD_MINOR; do
   sed -i "/CONFIG_${k}/d" "$DEF"
 done
 
 {
-  echo "CONFIG_SECURITY_YAMA=y"
+  echo "# CONFIG_SECURITY_YAMA is not set"
   echo "CONFIG_SLAB_FREELIST_RANDOM=y"
   echo "# CONFIG_USERFAULTFD is not set"
 } >> "$DEF"
 
-echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM, USERFAULTFD off) on $K"
+echo "OK: US-S5-1 defconfig (SLAB_FREELIST_RANDOM; YAMA, USERFAULTFD off) on $K"