009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

scripts/009-wait-flash-cve-clean.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# Wait for CVE-clean bacon on rom-dev01, then one-shot fastboot flash boot + one reboot.
+# No recovery loops. No auto-recover. Exits if not booted in ~4 min.
+set -euo pipefail
+SSHCFG="${SSHCFG:-/home/aventura/Workspaces/AXP_Resurection/docs/ssh/config}"
+SERIAL="${SERIAL:-11231JEC207477}"
+LOCAL="${LOCAL:-/home/aventura/Workspaces/AXP_Resurection/.local-artifacts/009-flash-cve-clean}"
+STATUS=detach-009-bacon-cve-clean.status
+LOG="${LOG:-/tmp/009-wait-flash-cve-clean.log}"
+mkdir -p "$LOCAL"
+exec > >(tee -a "$LOG") 2>&1
+
+echo "WAIT start $(date -Is)"
+st=""
+for i in $(seq 1 180); do
+  st=$(ssh -F "$SSHCFG" -o BatchMode=yes -o ConnectTimeout=20 rom-dev01 \
+    "cat /srv/rom/artifacts/$STATUS" 2>/dev/null || echo status_unreadable)
+  echo "poll $i: $st"
+  if echo "$st" | grep -q '^exit=0'; then
+    break
+  fi
+  if echo "$st" | grep -qE '^exit=[1-9]|^exit=killed'; then
+    echo BACON_FAILED
+    exit 1
+  fi
+  sleep 60
+done
+echo "$st" | grep -q '^exit=0' || { echo TIMEOUT; exit 1; }
+
+ART=$(ssh -F "$SSHCFG" -o BatchMode=yes rom-dev01 \
+  'ls -dt /srv/rom/artifacts/009-axp-los23-port/*-axp-stage1-combo4-cve-clean 2>/dev/null | head -1')
+echo "ART=$ART"
+test -n "$ART"
+
+rsync -avP -e "ssh -F $SSHCFG -o BatchMode=yes" \
+  "rom-dev01:$ART/boot.img" "rom-dev01:$ART/README.txt" "rom-dev01:$ART/SHA256SUMS" "$LOCAL/"
+cd "$LOCAL"
+grep ' boot.img$' SHA256SUMS | sha256sum -c -
+
+adb start-server >/dev/null 2>&1 || true
+cur=$(adb -s "$SERIAL" get-state 2>/dev/null || true)
+if [[ "$cur" == "device" ]]; then
+  echo "adb reboot bootloader once"
+  adb -s "$SERIAL" reboot bootloader
+fi
+for j in $(seq 1 40); do
+  fastboot devices 2>/dev/null | grep -q "$SERIAL" && break
+  sleep 2
+done
+fastboot devices | grep -q "$SERIAL" || { echo NO_FASTBOOT; exit 1; }
+
+echo "fastboot flash boot (cve-clean) once"
+fastboot -s "$SERIAL" flash boot "$LOCAL/boot.img"
+echo "fastboot reboot once"
+fastboot -s "$SERIAL" reboot
+
+for j in $(seq 1 60); do
+  sleep 5
+  cur=$(adb devices | awk -v s="$SERIAL" '$1==s{print $2}')
+  boot=$(adb -s "$SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r' || true)
+  echo "t=$((j*5))s adb=$cur boot=$boot"
+  if [[ "$cur" == "device" && "$boot" == "1" ]]; then
+    adb -s "$SERIAL" shell 'uname -a; getprop ro.boot.slot_suffix; pidof magiskd || true'
+    echo CLEAN_BOOT_OK
+    exit 0
+  fi
+  if [[ "$j" -eq 48 ]]; then
+    echo NOT_BOOTED_4min leave_alone
+    exit 2
+  fi
+done
+echo BOOT_TIMEOUT
+exit 2