009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/009-bacon-avb-flags0.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Isolated AVB flags 0 candidate. Same ship pack as the release-key bacon.
+# WITH_AVB=true makes device/google/sunfish/BoardConfigLineage.mk skip
+# `--flags 3`. The project avb.pem and SHA256_RSA4096 stay.
+# Do not start this while another ninja owns /srv/rom/src/lineage/out.
+# Do not flash until the zip is checked and the owner asks. LAB only.
+set -euo pipefail
+export AXP_AVB_FLAGS=0
+export WITH_AVB=true
+exec "$(dirname "$0")/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh"