009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/patches/009-kernel-hardening/uss5-1-README.md

@@ -30,13 +30,19 @@ Stage1+combo4+CVE apply.
 ```text
 zcat /proc/config.gz | grep CONFIG_SECURITY_YAMA=y
 zcat /proc/config.gz | grep CONFIG_SLAB_FREELIST_RANDOM=y
-cat /proc/sys/kernel/yama/ptrace_scope   # expect 1 (default)
+cat /proc/sys/kernel/yama/ptrace_scope   # expect 2 (ship policy)
 pidof magiskd                            # still up
 ```
 
+The ship script now applies `apply_009_yama_ptrace.py`, so the current LAB
+policy is `ptrace_scope=2`, not the kernel default `1`. Matching AXP's
+`persist.native_debug` 0/2 toggle is a separate userspace change and must not
+be mixed into the CVE-2022-49980 boot test.
+
 ## Out of scope here
 
-- `CVE-2022-49980` lock-scope port (still denylist)
+- The original `CVE-2022-49980/ANY/0001.patch` remains denylisted. The next
+  isolated bacon applies `ports/cve-2022-49980-lock-scope.patch` instead.
 - nf_tables high-offset CVEs
 - Stage1 slab FAIL patches (`0010`/`0018` still reject on this tree)
 - `hardened_malloc` / bootloader lock