[T-Mobile Samsung Galaxy S 5] rmanne:
I don't see anyone else posting here about it, so I just wanted to provide you guys with something to start out with.

First things first: Full Untouched ROM | Brokenly Debloated ROM

The Full Untouched ROM is exactly as it says, the ROM is extracted directly from the source and the permissions were set using the result of `ls -kR` and `ls -lnR` on an installed version of the ROM (see below for scripts). The Brokenly Debloated ROM does not have a functional Gallery (tbh, I probably just debloated too hard, and now I'm not sure which one was the essential one, something something camera3d.remote.nearby.Nearby??, but I don't use the Gallery, nor the Camera, so I removed them with TWRP's file manager), and I removed basically all the features that don't interfere with Wifi Calling (including Inprivate, Fingerprint, most of the Noto fonts removed (which support international fonts), removed all but 1 type of sound in each file, removed boot sound, removed even the Calculator) and then removed some of the things I don't like about stock. See below guides for more information. If you also happen to share my tastes and like it when there is almost nothing installed on your phone, then you should definitely try out the Broken Debloated ROM (it's actually very stable minus the Gallery), but if you want things like the Gallery or a Calculator or international fonts, find a different ROM, or take the Full one and debloat it.

Ok now, the good (and different) things about Marshmallow, and the things that I'm sure all you developers will like. (Note, this is for the Full ROM and should work with any Stock ROM, the Debloated version already has these applied).

Removing Knox info from Settings

Edit `/system/buildprop`, replace `ro.config.knox=v30` with `ro.config.knox=0`.

Yep, that's all, no patching, no fancy apktool baksmali magic requiring deodex.

Removing the S-Finder/QuickConnect Bar

Just delete `/system/etc/permissions/com.sec.feature.findo.xml`

Again, no patching.

Call Recording (this one isn't really new, it was more or less the same even in the past, but I included it anyways)

Add `<CscFeature_VoiceCall_ConfigRecording>RecordingAllowed</CscFeature_VoiceCall_ConfigRecording>` to `/system/csc/others.xml` anywhere between the `<FeatureSet> ... </FeatureSet>` tags.

I don't plan on searching for more, this is pretty comprehensive for my desires as it is, but if I happen to find them, I'll update this post.

Scripts

Note: this section is most likely unnecessary, since the updater-script already contains all of the below.

Links.hs opens "user.txt" and generates all the symlinks you need and outputs it to stdout.

Combine.hs opens "user.txt" and "sec.txt" and combines them so that the security contexts and permissions are in the same stream of text and outputs it to stdout.

Permissions.hs opens "allfiles.txt" and generates all the set_metadata requried arguments and outputs it to stdout.

If you want just the updater-script, it's also attached, all of the text from lines 24-123 were autogenerated by concatenating the outputs of Links.hs and Permissions.hs.

Also, as you can see, root is not included, but to be completely honest, the only thing I used to use root for was blocking ads. So I also including the Adblocker recovery-flashable zip I'm using (hosts file from here, updated as of 2016-05-24). It works even when SELinux is set to enforcing by properly updating the metadata (which it is in the ROMs posted in this thread).