009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-golden-lab-packages-20261009.md

@@ -0,0 +1,24 @@
+# GOLDEN reference vs LAB packages — 2026-10-09
+
+GOLDEN was **not** on USB. Comparison uses the frozen oracle dump
+`/srv/rom/references/axp/golden/2026-09-13/packages.txt` (owner-installed /
+spot-check format, not `pm list packages -f` of the full system image).
+
+A live LAB `pm list packages -f` was **not** captured in this pass: scratch
+started immediately after `adb reboot bootloader` (broken pipe during reboot).
+
+## Reference excerpt (GOLDEN dump)
+
+Curated hits from the oracle file include Island, Swissquote, microG/Phonesky,
+F-Droid/Aurora, Lineage recorder, Yuh, etc. See the full file on `rom-dev01`.
+
+## When GOLDEN is on USB
+
+```bash
+adb -s 11071JEC203839 shell pm list packages -f | sort > /tmp/golden-live.txt
+adb -s 11231JEC207477 shell pm list packages -f | sort > /tmp/lab-live.txt
+diff -u /tmp/golden-live.txt /tmp/lab-live.txt
+```
+
+Merge results into `docs/009-closure-parity-20261009.md` (system surface table
+stays authoritative for deblob; package list diff is for user-installed drift).