009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-gate-g-kernel-attribution.md

@@ -6,6 +6,19 @@ AVB/signing gaps (or “impossible on this stack”). This file is that list for
 **kernel** half. Userspace AVB is tracked separately below as still open.
 
 **LAB device:** `11231JEC207477` only.  
+
+> **2026-10-07 correction / next bacon:** LAB currently runs the
+> `20261007T133154Z` PRO/user/release-keys artifact. Audit found that Stage1
+> treated `misc/0021` as reversed and silently changed the LOS base's
+> `KSYM_NAME_LEN` from 192 to 128 while `CONFIG_CFI_CLANG=y`. The next recipe
+> removes that already-present patch, invokes Stage1 with `patch --forward`,
+> and gates `KSYM_NAME_LEN=192`. Artifact `20261007T161115Z` is quarantined
+> and must not be flashed. Its corrected replacement,
+> `20261007T171530Z`, completed all artifact gates and keeps the original CVE
+> one-liner denylisted while testing only the lock-scope companion as the new
+> kernel delta. It remains **unflashed** pending LAB USB-gadget acceptance.
+> The historical acceptance record below remains unchanged.
+
 **Accepted kernel ship pack (LAB 2026-10-01):** Stage1 Graphene/AH + combo4 +
 Clang FORTIFY + Magisk preroot + **CVE clean-offset 429** + **hi-batch1+2 (15)**
 with `CVE-2022-49980` denylisted. Clean-only `#47` / hi-batch1 `#48` remain bisect GOODs.