009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

specs/008-call-rec-flag-secure/contracts/flag-secure-surface.md

@@ -12,7 +12,7 @@
 | Readback | `adb shell settings get secure disable_secure_windows` |
 | UI preference key | `allow_flag_secure_override` (writes the Secure key above) |
 | Scope | **Global** (all apps); per-app lists not planned |
-| Note | WMS only applies this on **debuggable** builds (`ro.debuggable`) |
+| Note | Stock AOSP gated WMS on `ro.debuggable`; project removes that gate (`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`) so `ro.debuggable` stays `0` |
 
 ## Capture behaviour