009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/patches/009-kernel-hardening/cve-denylist.txt

@@ -0,0 +1,38 @@
+# relative to AXP kernel_patches
+# LAB 2026-10-01: alone ⇒ Google-logo hang (udc_lock recursive deadlock on
+# msm-4.14; needs lock-scope companion, not one-liner). Do not re-apply.
+CVE-2022-49980/ANY/0001.patch
+CVE-2017-15832/qcacld-3.0/0001.patch
+CVE-2021-29648/^5.11/0001.patch
+CVE-2022-33246/audio-kernel/0002.patch
+CVE-2022-49545/ANY/0001.patch
+CVE-2022-49552/ANY/0001.patch
+CVE-2022-49801/ANY/0001.patch
+CVE-2022-50421/ANY/0001.patch
+CVE-2023-33064/audio-kernel/0001.patch
+CVE-2023-33065/audio-kernel/0001.patch
+CVE-2023-43528/audio-kernel/0001.patch
+CVE-2023-52741/^6.2/0001.patch
+CVE-2023-53103/ANY/0001.patch
+CVE-2023-53660/ANY/0001.patch
+CVE-2024-21459/qca-wifi-host-cmn/0001.patch
+CVE-2024-38564/^6.9/0001.patch
+CVE-2024-56553/ANY/0001.patch
+CVE-2024-56554/ANY/0001.patch
+CVE-2024-56692/ANY/0001.patch
+CVE-2024-56780/ANY/0001.patch
+CVE-2025-21629/ANY/0001.patch
+CVE-2025-21653/ANY/0001.patch
+CVE-2025-21762/ANY/0001.patch
+CVE-2025-21764/ANY/0001.patch
+CVE-2025-21765/ANY/0001.patch
+CVE-2025-21859/ANY/0001.patch
+CVE-2025-21954/ANY/0001.patch
+CVE-2025-22035/ANY/0001.patch
+CVE-2025-37785/ANY/0001.patch
+CVE-2025-37960/ANY/0001.patch
+CVE-2025-38099/ANY/0001.patch
+CVE-2025-38253/ANY/0001.patch
+CVE-2025-38677/ANY/0001.patch
+CVE-2025-39770/ANY/0001.patch
+CVE-2025-39813/ANY/0001.patch