009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/magisk.mk

@@ -0,0 +1,15 @@
+# Magisk preroot (009) — clean Magisk, stock UI, no modules.
+# Wiring: vendor/sunfish-a16/magisk/{prepare_magisk.sh,patch.sh,apply_releasetools_hook.py}
+# Runtime: SUNFISH_A16_MAGISK_PREROOT=1 + prepare_magisk.sh before packaging.
+# Magisk is NOT a PRODUCT_PACKAGE (EXTENDROM-style preroot).
+
+# No packages — boot is patched at releasetools time.
+
+# US-S2 release keys (PRODUCT_DEFAULT_DEV_CERTIFICATE) — see signing.mk
+$(call inherit-product-if-exists, vendor/sunfish-a16/signing.mk)
+
+# OTA / version branding (TARGET_UNOFFICIAL_BUILD_ID=AXP-Resurection-Pro)
+$(call inherit-product-if-exists, vendor/sunfish-a16/branding.mk)
+
+# US-S4-1 userspace hardening (drop product OpenSSH, etc.)
+$(call inherit-product-if-exists, vendor/sunfish-a16/hardening.mk)