009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/009-axp-los23-port/signing/README.md

@@ -69,12 +69,12 @@ guarantee). Do not relock the bootloader on this Magisk track.
 
 ## Branding
 
-`TARGET_UNOFFICIAL_BUILD_ID=AXP-Resurection-Pro` is set at the **top** of
-`device/google/sunfish/lineage_sunfish.mk` (before inheriting
-`vendor/lineage` → `version.mk`). Helper:
-`apply_009_unofficial_build_id.py`. **Pro** = full Magisk resurrection track
-(not a future slim/minimal variant). Mirrors GOLDEN’s `…-sunfish-pro` /
-releasetype `PRO` intent without patching `vendor/lineage/config/version.mk`.
+Ship identity follows AXP/GOLDEN, not Lineage's unofficial channel.
+GOLDEN (`22.2-2026.003-sunfish-pro`) reports `ro.lineage.releasetype=PRO`,
+`ro.build.tags=release-keys`, and a version ending in `sunfish-pro`.
+`TARGET_UNOFFICIAL_BUILD_ID` forces Lineage `UNOFFICIAL` and is not that
+scheme. The next bacon sets `PRO` + `release-keys` + `…-sunfish-pro`.
+**Pro** remains the full Magisk track (AXP PRO, not SLIM).
 
 `branding.mk` adds `ro.axp.resurection.track=pro`. Ship scripts also publish
 `AXP-Resurection-Pro-<ver>-<date>-sunfish.zip` as a hardlink/copy of the