009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/009-bacon-wave4-deblob.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# Wave 4 deblob candidate: closure pack plus diag/bpftool/imsrcsd drops.
+# Same AVB flags-0 track as the booted closure baseline. Do not flash until
+# checked. LAB only. Do not run while another ninja owns out/.
+set -euo pipefail
+export AXP_AVB_FLAGS=0
+export WITH_AVB=true
+export AXP_DEBLOB_WAVE4=1
+exec "$(dirname "$0")/009-bacon-axp-stage1-combo4-cve-hi-releasekeys.sh"