009: Magisk ship pack through US-S5-1 + US-S4 OpenSSH/Jelly/Gallery2.

Release-keys/AVB, CVE clean+hi batches, Yama/slabrand, Pro branding,
bundled apps, and AXP-class product surface docs/scripts.

vendor/sunfish-a16/signing.mk

@@ -0,0 +1,17 @@
+# US-S2 — project release keys (Gate G).
+# Soong requires paths inside ANDROID_BUILD_TOP (absolute $HOME/.android-certs panics).
+# Host: copy keys into vendor/sunfish-a16/certs/ (gitignored). See docs/009-hardening-signing-checklist.md
+
+_AXP_CERT_DIR := vendor/sunfish-a16/certs
+
+ifneq ($(wildcard $(_AXP_CERT_DIR)/releasekey.pk8),)
+  PRODUCT_DEFAULT_DEV_CERTIFICATE := $(_AXP_CERT_DIR)/releasekey
+  PRODUCT_OTA_PUBLIC_KEYS := $(_AXP_CERT_DIR)/releasekey.x509.pem
+  # Without this, non-Google BT apex keeps AOSP security/bluetooth.x509.pem in
+  # plat_mac_permissions while apps sign with $(_AXP_CERT_DIR)/bluetooth →
+  # seinfo=default → zygote setcontext fails → Bluetooth crash loop (LAB 2026-10-02).
+  PRODUCT_MAINLINE_BLUETOOTH_SEPOLICY_DEV_CERTIFICATES := $(_AXP_CERT_DIR)
+endif
+
+# Host setup: also symlink certs/testkey.{pk8,x509.pem} -> releasekey.*
+# (system/sepolicy keys.conf @RELEASE still references testkey.x509.pem in this dir).