009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/hardening.mk

@@ -0,0 +1,29 @@
+# US-S4 — userspace hardening (AXP Resurection Pro).
+# Match AXP.OS PRO sunfish product surface (see hardening/README.md +
+# docs/009-axp-pro-product-apps-20260324.md).
+#
+# Real strips:
+#   US-S4-1 apply_009_drop_openssh_packages.py (common.mk)
+#   US-S4-2 apply_009_drop_jelly_gallery2.py (Jelly + Gallery2)
+# PRODUCT_PACKAGES filter-out via inherit alone has failed before — keep as
+# belt-and-suspenders only.
+
+PRODUCT_PACKAGES := $(filter-out \
+    scp \
+    sftp \
+    ssh \
+    sshd \
+    sshd_config \
+    ssh-keygen \
+    start-ssh \
+    rsync \
+    Jelly \
+    Gallery2 \
+    Glimpse \
+    ,$(PRODUCT_PACKAGES))
+
+PRODUCT_PACKAGES += NoLineageJelly
+
+PRODUCT_PACKAGES_DEBUG := $(filter-out procmem,$(PRODUCT_PACKAGES_DEBUG))
+
+# Keep init.openssh.rc — AXP PRO still ships it (mkdir /data/ssh* only).