009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_012_hardened_malloc.py

@@ -0,0 +1,34 @@
+"""012 hardened_malloc port keeps the AXP/Graphene exclusions."""
+from __future__ import annotations
+
+import pathlib
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+APPLY = (
+    ROOT
+    / "vendor/sunfish-a16/patches/012-hardened-malloc/apply_012_hardened_malloc.py"
+)
+WRAPPER = (
+    ROOT
+    / "vendor/sunfish-a16/patches/012-hardened-malloc/h_malloc_wrapper.cpp"
+)
+
+
+class HardenedMallocPort(unittest.TestCase):
+    def test_pin_and_exclusions(self) -> None:
+        text = APPLY.read_text()
+        self.assertIn("1d7fc7ffe0f8068a32ab2ba33df7515e7bad3f5f", text)
+        self.assertIn("/system/bin/surfaceflinger", text)
+        self.assertIn('strstr(exe_path, "camera")', text)
+        self.assertIn("max_map_count 1048576", text)
+        self.assertIn("USE_H_MALLOC", text)
+        self.assertIn('REGION_39BIT = "-DCONFIG_CLASS_REGION_SIZE=2147483648"', text)
+        self.assertIn("text.replace(REGION_48BIT, REGION_39BIT)", text)
+        self.assertIn('lost noinline', text)
+        self.assertTrue(WRAPPER.is_file())
+        self.assertIn("h_malloc_info", WRAPPER.read_text())
+
+
+if __name__ == "__main__":
+    unittest.main()