I'll provide information in line with my colleagues running the other main project accounts.

You can manually power off the device.

GrapheneOS provides auto-reboot and zeroing of all data when it's freed, which work together to mitigate these classes of vulnerabilities. In general, getting the device back at rest is critical and we plan to provide more than the already available auto-reboot feature for that.
 

 Are at-rest profiles (without rebooting, after "end session") safe from this attack? 

 Yes 

 Do we still get carrier sms/calls and alarms when it auto-reboots?