009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/008-call-rec-flag-secure/README.md

@@ -10,9 +10,11 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f
 
 - **Call recording**: EXTENDROM `er.sh` F_CALLREC / AXP GOLDEN
   (`extendrom_call_recording`). steadfasterX EXTENDROM.
-- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` already
-  wired in `WindowManagerService` on A16; DO preference
-  `allow_flag_secure_override` writes that key.
+- **FLAG_SECURE**: AOSP `Settings.Secure.DISABLE_SECURE_WINDOWS` + DO
+  preference `allow_flag_secure_override`. Stock WMS only applies the
+  setting when `ro.debuggable=1`; we remove that gate via
+  `apply_wms_disable_secure_debuggable_gate.py` so ship images keep
+  `ro.debuggable=0` while the toggle still works.
 
 ## Touched paths
 
@@ -24,9 +26,15 @@ python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_008_call_rec_f
 | Settings controllers | `…/ER_CallRec*.java`, `…/FlagSecureOverride*.java` |
 | Settings DO XML + strings | `res/xml/development_settings.xml`, `res/values/strings.xml` |
 | Dashboard | `DevelopmentSettingsDashboardFragment.java` |
-| Capture path | stock WMS `disable_secure_windows` (no extra WM patch) |
+| Capture path | WMS `updateDisableSecureWindows()` — **no** `ro.debuggable` gate |
+| WMS apply | `apply_wms_disable_secure_debuggable_gate.py` |
+
+```bash
+python3 vendor/sunfish-a16/patches/008-call-rec-flag-secure/apply_wms_disable_secure_debuggable_gate.py
+```
 
 Backups: `/srv/rom/artifacts/008-call-rec-flag-secure/bak-snapshots/`  
-Marker: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`
+Markers: `SUNFISH_A16_008_CALL_REC_FLAG_SECURE`,
+`SUNFISH_A16_008_WMS_DISABLE_SECURE_NO_DEBUGGABLE_GATE`
 
 See `docs/008-call-rec-flag-secure-runbook.md`.