009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

specs/009-axp-los23-port/spec.md

@@ -410,14 +410,16 @@ work when published.
   equivalent — not an unrelated Graphene A13 / stock A13 prebuilt), with
   **attributable kernel hardening** ported from AXP / Graphene / Divest where
   still valid on non-GKI 4.14. Skipped items MUST be documented with rationale.
-- **FR-018**: *(Deferred research — look later)* Compare how AXP/GOLDEN
-  hardens or constrains **localization / location** (network location,
-  backends, permissions, privacy toggles) versus stock LineageOS 23 behaviour.
-  Owner historically finds AXP aggressive here; do **not** freeze a
-  clone-or-LOS policy in this feature’s acceptance until that comparison
-  exists. Default until then: do not silently invent extra location lockdown
-  beyond what the rest of the AXP clone already implies; record the open
-  question in the capability matrix.
+- **FR-018**: Location uses the **LineageOS 23.2** stack so a fix stays
+  accurate and fast. Do **not** port AXP's location lockdown and do **not**
+  delete the IZat / XTRA / xtwifi blobs. SUPL stays available. A settings
+  toggle may force it off and defaults off. A second settings toggle,
+  default off, stops LPP (LPPE rides that session), the framework XTRA
+  download, and `loc_launcher` (xtra-daemon, lowi, IZat) without removing
+  the binaries. The GNSS stack never sends IMSI or the phone number to a
+  SUPL server. GNSS NTP is `2.android.pool.ntp.org`. Degoogle elsewhere
+  where a free replacement keeps the function; microG and the
+  project-patched Play Store stay.
 - **FR-019**: On a **final** shipping `009` image, owner MUST be able to
   refresh bundled **system / privileged** packages by **sideload** (or the
   documented Magisk-equivalent path) roughly every **2–3 months**, without