009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/009-bacon-hardened-malloc.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# 012 bacon: current ship pack plus Graphene hardened_malloc.
+# Compiles libc first. The full bacon runs only if that link succeeds.
+# Does not change AVB flags or run the userspace deblob.
+set -e
+cd /srv/rom/src/lineage
+export HOME=/home/android-build
+export CCACHE_DIR=/srv/rom/ccache
+export USE_CCACHE=1
+export PATH=/home/android-build/bin:/usr/local/bin:/usr/bin:/bin:$PATH
+unset OUT_DIR || true
+
+python3 vendor/sunfish-a16/patches/012-hardened-malloc/apply_012_hardened_malloc.py
+grep -q 'SUNFISH_A16_012_HARDENED_MALLOC' bionic/libc/Android.bp
+grep -q 'libhardened_malloc' bionic/libc/Android.bp
+grep -q 'CONFIG_CLASS_REGION_SIZE=2147483648' external/hardened_malloc/Android.bp
+grep -A1 '__attribute__((noinline))$' bionic/libc/bionic/libc_init_dynamic.cpp | grep -q '__libc_preinit_impl'
+test -f external/hardened_malloc/h_malloc.c
+
+set +u
+# shellcheck disable=SC1091
+source build/envsetup.sh
+set -e
+export PRODUCT_DEFAULT_DEV_CERTIFICATE=vendor/lineage-priv/keys/releasekey
+breakfast sunfish user
+echo "=== m libc $(date -Is) ==="
+m libc -j8
+echo "=== libc ok, starting bacon $(date -Is) ==="
+exec /srv/rom/artifacts/bin/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh