009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

AGENTS.md

@@ -18,6 +18,10 @@ unless the owner explicitly asks.
 
 ## Sources of truth
 
+Resume point for the unfinished ROM (2026-10-08): `docs/009-handoff-20261008.md`.
+Read that before the older remaining-work docs; several of those still describe
+pre-boot state.
+
 1. **Constitution** (`.specify/memory/constitution.md`) — global project rules
    for this Magisk-resurrection track.
 2. **Feature `spec.md`** — especially `specs/009-axp-los23-port/spec.md`.