009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/005-sigspoof/apply_005_sigspoof.py

@@ -38,8 +38,23 @@ def backup(path: Path) -> None:
 def patch_computer_engine() -> None:
     path = TREE / "frameworks/base/services/core/java/com/android/server/pm/ComputerEngine.java"
     text = path.read_text()
+    # AXP/EXTENDROM spoofs on user images (GOLDEN ro.debuggable=0). LOS stock
+    # isDebuggable() would disable that on lineage_sunfish-user.
+    deb_gate = """    public static boolean isMicrogSigned(AndroidPackage p) {
+        if (!isDebuggable()) {
+            return false;
+        }
+"""
+    user_ok = """    public static boolean isMicrogSigned(AndroidPackage p) {
+        // %s: no isDebuggable() gate (AXP user / GOLDEN).
+""" % MARKER
     if MARKER in text:
-        print("ComputerEngine: already patched")
+        if deb_gate not in text:
+            print("ComputerEngine: already patched, user gate ok")
+            return
+        backup(path)
+        path.write_text(text.replace(deb_gate, user_ok, 1))
+        print("ComputerEngine: dropped isDebuggable gate")
         return
     backup(path)
 
@@ -78,9 +93,7 @@ def patch_computer_engine() -> None:
     }"""
 
     new_is = """    public static boolean isMicrogSigned(AndroidPackage p) {
-        if (!isDebuggable()) {
-            return false;
-        }
+        // SUNFISH_A16_005_SIGSPOOF: no isDebuggable() gate (AXP user / GOLDEN).
 
         // Allowlist the following apps:
         // * com.android.vending - microG Companion / patched Phonesky