009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/009-user-zip-audit-20261007.md

@@ -0,0 +1,35 @@
+# User zip audit — 20261007T022805Z (not flashed)
+
+Build finished `exit=0` at 2026-10-07T02:29:08Z. Session `009-user-bacon`.
+Log: `/srv/rom/artifacts/detach-009-user-bacon-20261006T203157Z.log`.
+No LAB flash, no wipe.
+
+Artifact: `/srv/rom/artifacts/009-axp-los23-port/20261007T022805Z-axp-stage1-combo4-cve-hi-releasekeys/`
+
+Ship zip (same bytes as the lineage twin):
+
+`AXP-Resurection-Pro-23.2-20261006-sunfish.zip`
+
+SHA256 `7c70944614a1002e83bba7c38e1ef3ab8baeb56bfb3f60a474f59230575ea5a9`
+
+## Checked on the host images
+
+| Check | Result |
+|-------|--------|
+| Lunch | `ro.build.flavor=lineage_sunfish-user`, `ro.build.type=user`, `ro.debuggable=0` |
+| Version | `23.2-20261006-UNOFFICIAL-AXP-Resurection-Pro-sunfish`, track `pro` |
+| OTA cert | `O=AXP-Resurection, OU=sunfish-a16, CN=release` (not AOSP testkey) |
+| `ro.build.tags` | `dev-keys` (Lineage unofficial). GOLDEN official PRO is `release-keys` |
+| `ro.lineage.releasetype` | `UNOFFICIAL` |
+| AVB | project key SHA256_RSA4096, flags `3`, boot/dtbo/vendor/system chain verified |
+| Magisk | `magiskboot_cpio_test=1` on the shipped boot |
+| KernelSU | no KernelSU strings in `boot.img`; ship script refused `CONFIG_KSU=y` |
+| microG | `system_ext/app/GmsCore`, versionCode `252432034`, versionName `0.3.17.252432` |
+| Jelly / Gallery2 | **absent** on product. FossifyGallery present |
+| Kernel pack | Stage1 + combo4 + FORTIFY + CVE-clean 429 + hi-batch1–3 + Yama |
+
+## Notes for the morning
+
+- `dev-keys` is the unofficial Lineage tag. The zip itself is signed with the project release key.
+- Jelly and Gallery2 were already removed in the tree, and the ship script still fails the build if those APKs are present. This zip does not contain them.
+- Flash stays a separate decision. Sideload the AXP zip; a boot-only flash is not enough.