009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

AGENTS.md

@@ -25,6 +25,28 @@ unless the owner explicitly asks.
    Magisk, microG, and related projects — prefer these over secondary blogs
    or guesses. KernelSU docs are reference-only here (optional recycle).
 
+## Clone AXP first (mandatory)
+
+This track is an **AXP.OS → LOS23/A16** resurrection (~clone). Default method:
+
+1. Find how AXP / EXTENDROM / GOLDEN did it **before inventing a local policy**:
+   shipped PRO/GOLDEN zips (`payload.bin` → partition images),
+   `/srv/rom/references/axp/` + EXTENDROM on `rom-dev01`, GOLDEN `adb`
+   oracle, and real AXP product trees — **not** only Lineage-looking
+   `upstream_*` mirrors on disroot.
+2. **Copy that method** into this tree (same flags, same packaging shape, same
+   virgin/activation UX where applicable).
+3. Only invent or diverge when LOS 23.2, Android 16, or a newer dependency
+   **breaks** the AXP path — then document why and the minimal fix.
+
+Do **not** redesign Magisk, microG, Phonesky, DNS, connectivity, hardening
+package sets, or other AXP-class features “our way” for convenience.
+KernelSU/SusFS (`007`) stays **standby** — never mix into Magisk ship boots.
+
+Magisk specifically: EXTENDROM `EXTENDROM_PREROOT_BOOT` (boot patch, Magisk
+**not** a `PRODUCT_PACKAGE`, dormant until Additional Setup). See
+`docs/009-magisk-preinstall-runbook.md`.
+
 ## Working rules
 
 - Do not invent unresolved technical decisions; investigate them in the relevant