009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

scripts/009-watch-then-cve-bacon.sh

@@ -0,0 +1,54 @@
+#!/bin/bash
+# Wait for release-keys bacon to finish, then start Stage1+combo4+CVE bacon.
+set -euo pipefail
+RK_STATUS=/srv/rom/artifacts/detach-009-bacon-axp-stage1-combo4-rk.status
+CVE_NAME=009-bacon-axp-stage1-combo4-cve
+CVE_SCRIPT=/srv/rom/artifacts/bin/009-bacon-axp-stage1-combo4-cve.sh
+DETACH=/srv/rom/artifacts/bin/rom-detach
+
+echo "watcher: waiting for RK bacon to leave 'running' ($(date -Is))"
+while true; do
+  if [[ -f "$RK_STATUS" ]]; then
+    if grep -q '^exit=' "$RK_STATUS" 2>/dev/null; then
+      break
+    fi
+    if ! grep -q '^running ' "$RK_STATUS" 2>/dev/null; then
+      break
+    fi
+  else
+    # no status → assume free
+    break
+  fi
+  # still building?
+  if ! pgrep -f 'm bacon -j' >/dev/null 2>&1 \
+     && ! pgrep -f 'combined-lineage_sunfish.ninja' >/dev/null 2>&1; then
+    # status stale?
+    sleep 30
+    if ! pgrep -f 'm bacon -j' >/dev/null 2>&1; then
+      echo "watcher: no mka/ninja; treating RK as done ($(date -Is))"
+      break
+    fi
+  fi
+  sleep 60
+done
+
+echo "watcher: RK status now:"
+cat "$RK_STATUS" 2>/dev/null || true
+
+if grep -q '^exit=0' "$RK_STATUS" 2>/dev/null; then
+  echo "watcher: RK bacon OK"
+elif grep -q '^exit=' "$RK_STATUS" 2>/dev/null; then
+  echo "watcher: RK bacon FAILED — still launching CVE (kernel will reset)"
+else
+  echo "watcher: RK status unclear — launching CVE after short settle"
+  sleep 15
+fi
+
+# Ensure scripts synced into lineage vendor
+KH=/srv/rom/src/lineage/vendor/sunfish-a16/patches/009-kernel-hardening
+test -x "$CVE_SCRIPT"
+test -f "$KH/cve-strict.list"
+test -x "$KH/apply_stage1_combo4_cve.sh"
+
+"$DETACH" "$CVE_NAME" -- bash "$CVE_SCRIPT"
+echo "watcher: CVE bacon detached ($(date -Is))"