009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/hardening.mk

@@ -4,7 +4,9 @@
 #
 # Real strips:
 #   US-S4-1 apply_009_drop_openssh_packages.py (common.mk)
-#   US-S4-2 apply_009_drop_jelly_gallery2.py (Jelly + Gallery2)
+#   US-S4-2 Jelly stays (owner 2026-10-07). LOS 23 does not put it in
+#     common_mobile.mk, so it is added here. Gallery is FossifyGallery,
+#     not Gallery2 or Glimpse. Do not put Gallery2 back.
 # PRODUCT_PACKAGES filter-out via inherit alone has failed before — keep as
 # belt-and-suspenders only.
 
@@ -17,12 +19,11 @@ PRODUCT_PACKAGES := $(filter-out \
     ssh-keygen \
     start-ssh \
     rsync \
-    Jelly \
     Gallery2 \
     Glimpse \
     ,$(PRODUCT_PACKAGES))
 
-PRODUCT_PACKAGES += NoLineageJelly
+PRODUCT_PACKAGES += Jelly
 
 PRODUCT_PACKAGES_DEBUG := $(filter-out procmem,$(PRODUCT_PACKAGES_DEBUG))