upgrade ca-certificates package from v20260611-r0 to v20260909-r0

fixes CI build failure: apk refused to install ca-certificates
v20260611-r0, since alpine 3.24-stable's ca-certificates package
moved past that version (world constraint conflict).
https://github.com/fphammerle/docker-postfix/actions/runs/34675422117/job/105720703479

also add AGENTS.md, adapting the agent instructions from
fphammerle/location-guessing-game-telegram-bot (excluding the
Python-specific dependency-management rules, which don't apply here).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -0,0 +1,31 @@
+# Agent Instructions
+
+## Commit messages
+
+- Attribution line: `Co-Authored-By: Claude <model name> <noreply@anthropic.com>` — always include the model name,
+  e.g. `Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>`
+- Do **not** include a `Claude-Session:` line — the session URL is private.
+
+## CHANGELOG
+
+- Only document **user-facing** changes (features, bug fixes, removed support).
+
+## Pull requests
+
+- Rebase on `master` before opening a PR.
+- One commit per PR; amend rather than adding new commits.
+- Force-push with `--force-with-lease` on feature branches.
+- **Never force-push to `master`.**
+- **Always open a pull request — never push directly to `master`.**
+
+## CI failures
+
+- Fix CI failures automatically, iterating until all checks are green — no need to ask first.
+
+## GitHub comments that @-mention a bot
+
+- Commands like `@dependabot rebase` must reach GitHub as plain text — tool-call composition can
+  silently insert stray characters (e.g. interpunct `·`) into `@mentions`, which stops the bot from
+  recognizing the command.
+- After posting such a comment, read it back and confirm the body matches exactly what was
+  intended; if not, fix it immediately with an update rather than leaving a broken command posted.

Dockerfile

@@ -15,7 +15,7 @@ ARG POSTFIX_PACKAGE_VERSION=3.11.7-r0
 # https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/
 # https://gitlab.alpinelinux.org/alpine/ca-certificates/-/commits/master
 # https://git.alpinelinux.org/aports/log/main/ca-certificates?h=3.24-stable
-ARG MOZILLA_CA_CERT_STORE_PACKAGE_VERSION=20260611-r0
+ARG MOZILLA_CA_CERT_STORE_PACKAGE_VERSION=20260909-r0
 RUN apk add --no-cache \
         ca-certificates=$MOZILLA_CA_CERT_STORE_PACKAGE_VERSION \
         postfix=$POSTFIX_PACKAGE_VERSION \