009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_009_a15_reboot_fixups.py

@@ -0,0 +1,47 @@
+#!/usr/bin/env python3
+"""A16 fixups keep the AXP reboot and QS-tile behavior."""
+import importlib.util
+import pathlib
+import tempfile
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+APPLIER = (
+    ROOT
+    / "vendor/sunfish-a16/patches/009-axp-los23-port/apply_009_a15_reboot_timeouts.py"
+)
+
+
+def load():
+    spec = importlib.util.spec_from_file_location("apply_009_a15_reboot_timeouts", APPLIER)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class RebootFixupTest(unittest.TestCase):
+    def test_a16_anchors(self) -> None:
+        src = load()
+        with tempfile.TemporaryDirectory() as tmp:
+            tree = pathlib.Path(tmp)
+            xml = tree / "systemui.xml"
+            keyguard = tree / "KeyguardViewMediator.java"
+            tile = tree / "QSTileImpl.java"
+            xml.write_text(src.XML_OLD)
+            keyguard.write_text(src.KEYGUARD_OLD)
+            tile.write_text(src.IMPORT_OLD)
+            src.replace_once(xml, src.XML_OLD, src.XML_NEW)
+            src.replace_once(keyguard, src.KEYGUARD_OLD, src.KEYGUARD_NEW)
+            src.replace_once(tile, src.IMPORT_OLD, src.IMPORT_NEW)
+            src.replace_once(xml, src.XML_OLD, src.XML_NEW)
+            self.assertIn("android.permission.REBOOT", xml.read_text())
+            self.assertIn(
+                "sendUserPresentBroadcast();\n        cancelDoRebootForOwnerAfterTimeoutIfEnabled();",
+                keyguard.read_text(),
+            )
+            self.assertIn("KeyguardStateController", tile.read_text())
+            self.assertNotIn("QsInCompose", tile.read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()