009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/009-kernel-hardening/apply_combo4_fortify.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# Apply the LAB-verified combo4 + Clang FORTIFY pack onto a clean msm-4.14 tree.
+#
+# Boot-OK on sunfish LAB 2026-09-28 (ksync combo4-fortify-fix). This is NOT
+# the full Graphene Stage1 pack (Stage1 alone historically hung at Google logo).
+#
+# Usage: apply_combo4_fortify.sh <kernel-tree>
+# Expects a virgin / reset tree (apply_fortify_clang.py is not idempotent).
+set -e
+
+K=${1:?kernel tree}
+HERE=$(cd "$(dirname "$0")" && pwd)
+FC="$HERE/fortify-clang"
+
+test -d "$K/include/linux"
+test -f "$FC/apply_fortify_clang.py"
+test -f "$FC/0001-driver-bounds-rtac-fils.patch"
+
+python3 "$FC/apply_fortify_clang.py" "$K"
+patch -p1 --forward --batch -d "$K" < "$FC/0001-driver-bounds-rtac-fils.patch"
+
+DEF="$K/arch/arm64/configs/sunfish_defconfig"
+test -f "$DEF"
+
+# Drop any prior toggles we manage, then enable the boot-OK set.
+for k in \
+  FORTIFY_SOURCE \
+  INIT_ON_ALLOC_DEFAULT_ON \
+  INIT_ON_FREE_DEFAULT_ON \
+  SECURITY_DMESG_RESTRICT \
+  SLAB_FREELIST_HARDENED \
+  SLAB_HARDENED
+do
+  sed -i "/CONFIG_${k}/d" "$DEF"
+done
+
+# Keep KernelSU off on this Magisk track.
+sed -i '/CONFIG_KSU/d' "$DEF"
+echo '# CONFIG_KSU is not set' >> "$DEF"
+
+for k in \
+  CONFIG_FORTIFY_SOURCE \
+  CONFIG_INIT_ON_ALLOC_DEFAULT_ON \
+  CONFIG_INIT_ON_FREE_DEFAULT_ON \
+  CONFIG_SECURITY_DMESG_RESTRICT \
+  CONFIG_SLAB_FREELIST_HARDENED
+do
+  echo "${k}=y" >> "$DEF"
+done
+
+echo "OK: combo4+FORTIFY applied on $K"