009: Polish bacon fixes, OTA host scripts, and migration docs.

Restore disable_configstore, EuiccDisabler and thermal CDEV guards, branding
and rebuild/sync helpers; document device roles, laptop migration, and Gitea.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/012-hardened-malloc/apply_012_hardened_malloc.py

@@ -57,28 +57,42 @@ def rewrite_region_comment(bp: pathlib.Path) -> None:
     print(f"region comment: {bp}")
 
 
+def _git(dest: pathlib.Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
+    cmd = ["git", "-c", f"safe.directory={dest}", "-C", str(dest), *args]
+    if check:
+        return subprocess.run(cmd, check=True, text=True, capture_output=True)
+    return subprocess.run(cmd, text=True, capture_output=True)
+
+
 def ensure_library() -> None:
     dest = TREE / "external/hardened_malloc"
     if (dest / ".git").is_dir():
-        head = subprocess.check_output(
-            ["git", "-C", dest, "rev-parse", "HEAD"], text=True
-        ).strip()
+        head = _git(dest, "rev-parse", "HEAD").stdout.strip()
         bp_text = (dest / "Android.bp").read_text()
         if head == PIN and MARKER in bp_text and REGION_39BIT in bp_text:
             rewrite_region_comment(dest / "Android.bp")
             print(f"hardened_malloc already at {PIN}")
             return
-        subprocess.check_call(["git", "-C", dest, "fetch", "--depth", "1", "origin", PIN])
-        subprocess.check_call(["git", "-C", dest, "checkout", "--detach", PIN])
+        _git(dest, "fetch", "--depth", "1", "origin", PIN)
+        _git(dest, "checkout", "--detach", PIN)
     else:
         if dest.exists():
             sys.exit(f"{dest} exists and is not a git checkout")
         dest.parent.mkdir(parents=True, exist_ok=True)
         subprocess.check_call(
-            ["git", "clone", "--depth", "1", REPO, str(dest)]
+            [
+                "git",
+                "-c",
+                f"safe.directory={dest}",
+                "clone",
+                "--depth",
+                "1",
+                REPO,
+                str(dest),
+            ]
         )
-        subprocess.check_call(["git", "-C", dest, "fetch", "--depth", "1", "origin", PIN])
-        subprocess.check_call(["git", "-C", dest, "checkout", "--detach", PIN])
+        _git(dest, "fetch", "--depth", "1", "origin", PIN)
+        _git(dest, "checkout", "--detach", PIN)
     bp = dest / "Android.bp"
     text = bp.read_text()
     mte = """        device_has_arm_mte: {
@@ -106,9 +120,7 @@ def ensure_library() -> None:
             1,
         )
     bp.write_text(text)
-    head = subprocess.check_output(
-        ["git", "-C", dest, "rev-parse", "HEAD"], text=True
-    ).strip()
+    head = _git(dest, "rev-parse", "HEAD").stdout.strip()
     if head != PIN:
         sys.exit(f"hardened_malloc HEAD {head} != {PIN}")
     print(f"hardened_malloc {PIN}")