009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-private-dns-axp-providers.md

@@ -0,0 +1,34 @@
+# AXP Private DNS providers (from GOLDEN Settings)
+
+Source: `Settings.apk` on GOLDEN `11071JEC203839`
+(`22.2-2026.003-sunfish-pro`), pulled 2026-09-18.
+Artifact: `.local-artifacts/002-golden/20260918-private-dns/Settings.apk`
+
+Stock AOSP/LOS radios: Off / Automatic / Provider hostname.
+AXP adds the following preset radios (hostname → DoT provider):
+
+| key (resource) | UI label (en) | hostname |
+|----------------|---------------|----------|
+| `adguard` | AdGuard (CT) | `dns.adguard.com` |
+| `appliedprivacy` | AppliedPrivacy (AT) | `dot1.applied-privacy.net` |
+| `cira` | CIRA (CA) | `protected.canadianshield.cira.ca` |
+| `cleanbrowsing` | CleanBrowsing (US) | `security-filter-dns.cleanbrowsing.org` |
+| `cloudflare` | Cloudflare (US) | `security.cloudflare-dns.com` |
+| `controld` | Control D (CA) | `p2.freedns.controld.com` |
+| `cznic` | CZ.NIC (CZ) | `odvr.nic.cz` |
+| `dnssb` | DNS.SB (DE) | `dot.sb` |
+| `dnszero` | DNS0 (FR) | `zero.dns0.eu` |
+| `google` | Google (US) | `dns.google` |
+| `mullvad` | Mullvad (SE) | `base.dns.mullvad.net` |
+| `quadnine` | Quad9 (CH) | `dns.quad9.net` |
+| `restena` | Restena (LU) | `kaitain.restena.lu` |
+| `switch` | SWITCH (CH) | `dns.switch.ch` |
+| `uncensoreddns` | UncensoredDNS (DK) | `anycast.censurfridns.dk` |
+
+Plus stock: Off, Opportunistic (Automatic), custom Provider hostname.
+
+AXP setup docs recommend Quad9 (`dns.quad9.net`) and DNS0 (`zero.dns0.eu`).
+
+Clone target for LOS 23.2: extend `PrivateDnsModeDialogPreference` +
+`private_dns_mode_dialog.xml` + strings to match this set (no `axp.os`
+branding).