009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/apps.mk

@@ -1,8 +1,19 @@
 # Bundled user apps (009) — Aurora Store, Droidify, Fossify Gallery.
 # APKs live on host at /srv/rom/prebuilts/axp-apps/ (never Git).
 # Symlink into vendor/sunfish-a16/prebuilt/ before bacon.
+#
+# OpenEUICC is the privileged LPA, same as AXP GOLDEN: system_ext priv-app,
+# platform certificate, privapp whitelist. Source is not an APK prebuilt.
+# Host tree: packages/apps/OpenEUICC @ upstream 89d677e07d0e (2026-09-28).
+# Not the AXP fork tag. Datastore comes from LOS androidx.
+# prebuilts/openeuicc-deps @ 5402167 (zxing only).
 
 PRODUCT_PACKAGES += \
     AuroraStore \
     Droidify \
-    FossifyGallery
+    FossifyGallery \
+    OpenEUICC
+
+# EuiccGoogle is removed by apply_009_drop_euicc_google.py. inherit-product
+# merges PRODUCT_PACKAGES per makefile, so a filter-out here does not see
+# the sunfish-vendor.mk entries.