009: Closure wave 3 deblob, handoff, and optional wave4/malloc bacons.

Ship script gates wave 4 behind AXP_DEBLOB_WAVE4, documents secrets cert path,
and adds deblob appliers plus tests; docs capture Swissquote fix and parity.

Co-authored-by: Cursor <cursoragent@cursor.com>

vendor/sunfish-a16/signing.mk

@@ -1,8 +1,13 @@
 # US-S2 — project release keys (Gate G).
 # Soong requires paths inside ANDROID_BUILD_TOP (absolute $HOME/.android-certs panics).
 # Host: copy keys into vendor/sunfish-a16/certs/ (gitignored). See docs/009-hardening-signing-checklist.md
+# apply_009_axp_identity.py copies them to vendor/lineage-priv/keys, the only
+# path for which build/make/core/config.mk sets BUILD_KEYS := release-keys.
 
 _AXP_CERT_DIR := vendor/sunfish-a16/certs
+ifneq ($(wildcard vendor/lineage-priv/keys/releasekey.pk8),)
+  _AXP_CERT_DIR := vendor/lineage-priv/keys
+endif
 
 ifneq ($(wildcard $(_AXP_CERT_DIR)/releasekey.pk8),)
   PRODUCT_DEFAULT_DEV_CERTIFICATE := $(_AXP_CERT_DIR)/releasekey