009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/009-kernel-hardening/cve-denylist.txt

@@ -1,6 +1,7 @@
 # relative to AXP kernel_patches
 # LAB 2026-10-01: alone ⇒ Google-logo hang (udc_lock recursive deadlock on
-# msm-4.14; needs lock-scope companion, not one-liner). Do not re-apply.
+# msm-4.14). Companion is ports/cve-2022-49980-lock-scope.patch (UAF fix
+# plus uevents outside the lock). Do not apply the one-liner by itself.
 CVE-2022-49980/ANY/0001.patch
 CVE-2017-15832/qcacld-3.0/0001.patch
 CVE-2021-29648/^5.11/0001.patch