009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/009-kernel-hardening/apply_uss5_1_defconfig.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+# US-S5-1 — enable remaining Graphene/AXP-class defconfig knobs on msm-4.14.
+#
+# Oracle: AXP/Graphene kernel hardening expects Yama + slab freelist random
+# (combo4 already ships SLAB_FREELIST_HARDENED). LOS sunfish_defconfig left both
+# off; CONFIG_LSM already lists yama but SECURITY_YAMA was unset so the LSM
+# never built.
+#
+# Does NOT apply high-offset CVE leftovers (nf_tables deliberately skipped) or
+# CVE-2022-49980 (denylist until lock-scope port).
+#
+# Usage: apply_uss5_1_defconfig.sh <kernel-tree>
+set -euo pipefail
+
+K=${1:?kernel tree}
+DEF="$K/arch/arm64/configs/sunfish_defconfig"
+test -f "$DEF"
+test -f "$K/security/yama/Kconfig"
+
+for k in SECURITY_YAMA SLAB_FREELIST_RANDOM; do
+  sed -i "/CONFIG_${k}/d" "$DEF"
+  # drop "# CONFIG_FOO is not set" lines too (sed above only matches CONFIG_FOO=)
+  sed -i "/# CONFIG_${k} is not set/d" "$DEF"
+done
+
+{
+  echo "CONFIG_SECURITY_YAMA=y"
+  echo "CONFIG_SLAB_FREELIST_RANDOM=y"
+} >> "$DEF"
+
+echo "OK: US-S5-1 defconfig (YAMA + SLAB_FREELIST_RANDOM) on $K"