009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitignore

@@ -7,6 +7,8 @@
 .idea/
 .vscode/
 .cursor/
+# Codex (ChatGPT) local project config — review agent; never commit
+.codex/
 # Spec Kit skills live in .agents/skills/ (tracked); Cursor may mirror under .cursor/
 
 # Spec Kit local state (also ignored under .specify/)
@@ -51,4 +53,5 @@ vendor/sunfish-a16/prebuilt/
 
 # Local AXP OTA extracts (payload.bin ~1GB+)
 AXP.OS-*/
+AXP.OS-*.zip
 *.bin