009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-hardening-signing-checklist.md

@@ -211,14 +211,27 @@ attribution. One stage per bacon when risk is unclear.
 - [x] **US-S5-1** LAB OK (`162840Z`): `CONFIG_SECURITY_YAMA=y` +
       `CONFIG_SLAB_FREELIST_RANDOM=y` — see
       `docs/009-lab-acceptance-20261002-uss5.md`
-- [ ] Optional later: `CVE-2022-49980` lock-scope port; Stage1 slab FAIL
-      retries; `hardened_malloc`
+- [ ] **Next cycle after the user image is accepted** (owner 2026-10-06):
+      close kernel CVE + Graphene/AXP hardening + deblob on that baseline.
+      Boot-check each batch (full `cve-strict` ~503 and `CVE-2022-49980`
+      alone hang at the Google logo). Inventory: remaining high-offset KEEP,
+      `49980` lock-scope port, Stage1 probes that failed
+      (allocsize/0007, ro/0007+0034, slab/0010+0018), `hardened_malloc`,
+      AXP deblob that still leaves radio, GPS and Widevine working.
+      Still out: location lockdown, bootloader relock, KernelSU, IPA removal.
+- [x] **Next-bacon recipe guard (2026-10-07):** Stage1 uses
+      `patch --forward`, omits already-present `misc/0021`, and fails unless
+      `KSYM_NAME_LEN=192`; full feature-008 call-recording apply is restored.
+      Quarantine the earlier `bacon00949980` build and do not flash it.
 
 Map updates: `docs/009-kernel-hardening-map.md` + Gate G attribution.
 
 ### US-S6 — Optional later
 
-- [ ] Switch default lunch to `lineage_sunfish-user` for ship
+- [ ] Confirm `lineage_sunfish-user` after flash
+      (bacon started 2026-10-06, tmux `009-user-bacon`, log
+      `/srv/rom/artifacts/detach-009-user-bacon-20261006T203157Z.log`.
+      PRO stays branding. Check `ro.build.type=user` and `release-keys` on LAB)
 - [ ] GPG-sign published SHA sums (AXP does; nice-to-have)
 - [ ] LOS23 nightly rebase (vanilla + re-apply Magisk/stage1/keys)
 - [ ] Bootloader lock — **wont**