AGENTS.md: sync with instructions of other repositories (#351)

The Dockerfile installs `[packages]` from `Pipfile.lock` into the container image, so the same pitfalls as in systemctl-mqtt apply: lock bumps aren't user-facing although they ship in the image, and they mustn't be described as test-only. CI tooling isn't user-facing either, as in the container image repositories. Other rules (blinkcheck, repository-specific pins, package `ARG` update convention) don't apply here.

Based on https://github.com/fphammerle/systemctl-mqtt/blob/10aae4d69c4a1e43edcbf482be8589ec0bb7206d/AGENTS.md and https://github.com/fphammerle/docker-onion-service/blob/1063660ad10d0df41fbb4e4083fabd2c510998e5/AGENTS.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

AGENTS.md

@@ -30,6 +30,10 @@
 - Only document **user-facing** changes (features, bug fixes, removed support).
 - Test tooling changes (e.g. `[dev-packages]` in `Pipfile`, `Pipfile.lock`) are not user-facing →
   no entry needed.
+- CI / build tooling changes (e.g. GitHub Actions workflows, `dependabot.yml`) are not
+  user-facing → no entry needed.
+- Version bumps in `Pipfile.lock` are **not** user-facing, even in the `default` section installed in
+  the container image (users run the bot, not its dependencies directly) → no entry needed.
 - Changes to the container image (`Dockerfile`, base image, `docker-compose.yml`) **are**
   user-facing → document them with a `` `dockerfile`: `` prefix, like existing entries.
 - Wording for Python version support: `declare compatibility with \`python3.X\`` (under
@@ -98,3 +102,5 @@
   `python_version >= '3.11'`). Fix by re-running `pipenv lock` on the lowest supported version.
 - When constrained packages (e.g. `setuptools`, `urllib3`) need to override transitive
   resolution, put them in `[packages]`, not `[dev-packages]`.
+- `[packages]` (`default` in `Pipfile.lock`) is installed in the container image too, not only in the
+  test environment — don't describe changes to it as test-only (e.g. "relock test environment").