Hopefully it's the base Debian with a thin vendor package set (kernel, u-boot, DTBs, firmware, out-of-tree DKMS, and a Halium-based bridge to HALs) tied together by a meta-package. With apt pinning, upgrades would become normal Debian transactions, security updates would track Debian, and the vendor layer stays limited to an LTS kernel delta, boot bits, and a small Halium shim.