009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/branding.mk

@@ -3,8 +3,8 @@
 # "Pro" marks the full Magisk-resurrection track (not a future slim/minimal
 # variant). GOLDEN used releasetype PRO + ro.lineage.version=…-sunfish-pro.
 #
-# TARGET_UNOFFICIAL_BUILD_ID is set in vendor/extra/product.mk (early Lineage
-# hook, before version.mk). BoardConfig + this file are not early enough alone.
+# LINEAGE_BUILDTYPE := PRO comes from apply_009_axp_identity.py (AXP Patch.sh
+# method), so ro.lineage.releasetype=PRO and the version is not UNOFFICIAL.
 # Ship scripts also publish AXP-Resurection-Pro-*.zip from lineage-*.zip.
 
 # Identity props (not axp.os endpoints). Empty on GOLDEN for ro.axp.version —