009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/004-phonesky-runbook.md

@@ -36,7 +36,7 @@ Host packaging: `vendor/sunfish-a16/{Android.mk,gms.mk,BoardConfig.mk}`.
 1. Download latest **default** `com.google.android.gms-NNNNNNN.apk` (no `-hw`) +
    `GsfProxy.apk` from microG GitHub releases. Match GOLDEN: `versionName`
    must **not** end in `-hw` (Huawei flavor drops NLP Location services /
-   UI). Example: `v0.3.16.252432` → `com.google.android.gms-252432032.apk`.
+   UI). Newest stable staged 2026-10-06: `v0.3.17.252432` → `com.google.android.gms-252432034.apk` (versionCode 252432034, default flavor, PRESIGNED).
 2. Keep **official signature** (`LOCAL_CERTIFICATE := PRESIGNED`). **Never**
    re-sign / ABI-strip GmsCore for size — that breaks F-Droid updates.
 3. Do **not** install microG’s `com.android.vending-*.apk` (FakeStore).