009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/magisk/prepare_magisk.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Stage Magisk v22+ APK into $OUT_DIR/.magisk (or MAGISK_STAGE_DIR) for preroot.
+# Attribute: sfX-android extendrom er.sh MAGISK block + Magisk upstream.
+set -euo pipefail
+TOP="${ANDROID_BUILD_TOP:-${1:-}}"
+OUT_DIR="${OUT_DIR:-$TOP/out}"
+STAGE="${MAGISK_STAGE_DIR:-$OUT_DIR/.magisk}"
+APK="${MAGISK_APK:-/srv/rom/prebuilts/magisk/Magisk-v30.7.apk}"
+ARCH="${MAGISK_TARGET_ARCH:-arm64}"
+
+if [ -z "$TOP" ] || [ ! -d "$TOP" ]; then
+  echo "Usage: ANDROID_BUILD_TOP=/path prepare_magisk.sh" >&2
+  exit 2
+fi
+test -f "$APK" || { echo "Missing Magisk APK: $APK" >&2; exit 4; }
+
+rm -rf "$STAGE"
+mkdir -p "$STAGE"
+unzip -q "$APK" -d "$STAGE/src"
+
+# Host tools (x86_64) for patching during build
+cp "$STAGE/src/lib/x86_64/libmagiskboot.so" "$STAGE/magiskboot" 2>/dev/null \
+  || cp "$STAGE/src/lib/x86/libmagiskboot.so" "$STAGE/magiskboot"
+chmod 755 "$STAGE/magiskboot"
+
+if [ "$ARCH" = "arm64" ]; then
+  if [ -f "$STAGE/src/lib/arm64-v8a/libmagisk64.so" ]; then
+    cp "$STAGE/src/lib/arm64-v8a/libmagisk64.so" "$STAGE/magisk64"
+  else
+    cp "$STAGE/src/lib/arm64-v8a/libmagisk.so" "$STAGE/magisk"
+  fi
+  cp "$STAGE/src/lib/arm64-v8a/libmagiskinit.so" "$STAGE/magiskinit"
+  [ -f "$STAGE/src/lib/arm64-v8a/libinit-ld.so" ] && cp "$STAGE/src/lib/arm64-v8a/libinit-ld.so" "$STAGE/init-ld"
+  [ -f "$STAGE/src/lib/arm64-v8a/libmagiskpolicy.so" ] && cp "$STAGE/src/lib/arm64-v8a/libmagiskpolicy.so" "$STAGE/magiskpolicy"
+else
+  echo "Unsupported MAGISK_TARGET_ARCH=$ARCH" >&2
+  exit 4
+fi
+
+chmod 755 "$STAGE/src/assets/boot_patch.sh"
+rm -rf "$STAGE/src/assets/dexopt" "$STAGE/src/assets/chromeos" 2>/dev/null || true
+cp "$STAGE/src/assets/"* "$STAGE/"
+cp "$STAGE/src/assets/boot_patch.sh" "$STAGE/root_boot.sh"
+chmod 755 "$STAGE/boot_patch.sh" "$STAGE/magiskinit" "$STAGE/magiskboot"
+[ -f "$STAGE/magisk64" ] && chmod 755 "$STAGE/magisk64"
+[ -f "$STAGE/magisk" ] && chmod 755 "$STAGE/magisk"
+[ -f "$STAGE/init-ld" ] && chmod 755 "$STAGE/init-ld"
+
+# Point patch.sh at our vendor copy
+MARKER="$STAGE/READY"
+echo "apk=$(basename "$APK")" > "$MARKER"
+echo "arch=$ARCH" >> "$MARKER"
+echo "staged=$(date -u -Iseconds)" >> "$MARKER"
+echo "OK Magisk staged at $STAGE"
+cat "$MARKER"