009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/magisk/README.md

@@ -0,0 +1,26 @@
+# Magisk preroot (sunfish-a16 / 009)
+
+**Policy:** clone AXP / EXTENDROM `EXTENDROM_PREROOT_BOOT` — do not invent.
+Diverge only if LOS23 or Magisk version breaks that path.
+
+**Clean Magisk**, stock UI. No GOLDEN modules. No KernelSU in ship kernel.
+
+| File | Role |
+|------|------|
+| `prepare_magisk.sh` | Unzip Magisk APK → `$OUT_DIR/.magisk` (same as extendrom `er.sh`) |
+| `patch.sh` | From sfX extendrom — patches boot.img via Magisk `boot_patch.sh` |
+| `apply_releasetools_hook.py` | Inject into releasetools `common.py` (A16) |
+
+AXP virgin UX: Magisk not a `PRODUCT_PACKAGE`; root inactive until user
+Additional Setup. See `docs/009-magisk-preinstall-runbook.md`.
+
+```bash
+export SUNFISH_A16_MAGISK_PREROOT=1   # optional; READY file is the real gate
+MAGISK_STAGE_DIR=$ANDROID_BUILD_TOP/out/.magisk \
+  vendor/sunfish-a16/magisk/prepare_magisk.sh
+python3 vendor/sunfish-a16/magisk/apply_releasetools_hook.py --top "$ANDROID_BUILD_TOP" --force
+```
+
+Hook **v2** runs when `out/.magisk/READY` exists (preferred) and/or
+`SUNFISH_A16_MAGISK_PREROOT=1`. Env alone is unreliable under soong/ninja.
+Without READY / env the hook no-ops.