upgrade ca-certificates package from 20260909-r0 to 20261020-r0 & sync AGENTS.md (#154)

Security upgrade of the Mozilla CA cert store: https://github.com/alpinelinux/aports/commit/e78f5987166c6ffbe23f6472e2e8f040298fe2da

AGENTS.md: bring in the rule against justifying package updates with the old pin no longer being installable (relevant for exactly this kind of update) and the reference for co-author trailers. Python / Pipfile rules and the CHANGELOG rules for container images in the other repositories don't apply here, as package updates of this image aren't tracked in `CHANGELOG.md`.
Based on https://github.com/fphammerle/docker-borgbackup-sshd/blob/706e2361cf86483323db45730a02fb29a864e1ab/AGENTS.md and https://github.com/fphammerle/docker-onion-service/blob/1063660ad10d0df41fbb4e4083fabd2c510998e5/AGENTS.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -13,6 +13,7 @@
 
 - Attribution line: `Co-Authored-By: Claude <model name> <noreply@anthropic.com>` — always include the model name,
   e.g. `Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>`
+  (see https://web.archive.org/web/20261016172400/https://docs.github.com/en/pull-requests/how-tos/commit-changes/creating-a-commit-with-multiple-authors)
 - Do **not** include a `Claude-Session:` line — the session URL is private.
 - Explain **why**, not what — don't restate in prose what's already obvious from `git diff` of
   the commit (e.g. "add a notice to the README", "update section X").
@@ -23,6 +24,10 @@
   in `Dockerfile`): keep the subject line `upgrade <package> package from <old> to <new>` and list
   the **relevant changes** of the new version in the body, taken from the upstream changelog
   linked in the comments above the version `ARG` (e.g. security fixes, behaviour changes).
+- Never justify a package version update with the old pinned version no longer being installable
+  or the build failing because of it (e.g. "so the pinned version can no longer be installed") —
+  pins are intentional and breaking when the distribution moves on is their whole point. Keep the
+  version pinned; this applies to PR descriptions as well.
 
 ## CHANGELOG
 

Dockerfile

@@ -15,7 +15,7 @@ ARG POSTFIX_PACKAGE_VERSION=3.11.7-r0
 # https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/
 # https://gitlab.alpinelinux.org/alpine/ca-certificates/-/commits/master
 # https://git.alpinelinux.org/aports/log/main/ca-certificates?h=3.24-stable
-ARG MOZILLA_CA_CERT_STORE_PACKAGE_VERSION=20260909-r0
+ARG MOZILLA_CA_CERT_STORE_PACKAGE_VERSION=20261020-r0
 RUN apk add --no-cache \
         ca-certificates=$MOZILLA_CA_CERT_STORE_PACKAGE_VERSION \
         postfix=$POSTFIX_PACKAGE_VERSION \