009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

docs/009-sideload-system-updates.md

@@ -0,0 +1,30 @@
+# 009 — Sideload system package updates (FR-019)
+
+Owner cadence: refresh bundled **system / privileged** packages about every
+**2–3 months** without a full ROM reflash. **No** AXP OTA / external repos.
+
+Status: **stub** — fill before final ship (task T046a). Packaging of the
+shipping image MUST already preserve update eligibility.
+
+## In scope
+
+| Component | Intended update path | Signing constraint |
+|-----------|----------------------|--------------------|
+| microG GmsCore / companions | `adb install -r` / recovery sideload of upstream APK | **PRESIGNED** / same signer as shipped |
+| Magisk | Magisk app self-update and/or documented boot re-patch | Manager + boot image must stay matched |
+| Project Phonesky | Sideload project-signed APK | **Same project key** across releases |
+| Other bundled system apps | Sideload matching-signer APK (or recovery zip if priv-app needs it) | Same identity as image |
+
+## Out of scope
+
+- Network OTA / AXP update servers
+- Full `bacon` + clean flash for routine APK bumps (still OK for kernel /
+  framework / Magisk boot changes when required)
+
+## Checklist before claiming FR-019 done
+
+- [ ] Each row above has a concrete command/runbook step
+- [ ] `pm install` / PackageManager does not reject for signature mismatch
+- [ ] Privileged permissions still grant after update (or re-flash privapp XML noted)
+- [ ] Magisk version after update matches kernel/boot expectation
+- [ ] Record new versions in `docs/009-version-pins.md`