docker: bump postgres from 18.4-alpine to 18.6-alpine

[dependabot]

Bumps postgres from 18.4-alpine to 18.6-alpine.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• postgres development image: 18.4-alpine → 18.6-alpine
• Reviewed head: e743706dea8ce56c1ba0ab6ffad595aba8b6e976

Security review

• Verified the exact Docker Hub index pin
  sha256:d3e1620b530c944afa6e887d22eb899824da68e19c52024bf98f5220c88a65b2,
  all platform manifests, common-platform SBOMs, embedded SLSA provenance,
  upstream image recipe, PostgreSQL source checksums, and Alpine package churn.
• The base image, supported platforms, entrypoint/init scripts, build recipe,
  runtime configuration, and package count are unchanged. Package changes are
  the intended PostgreSQL release plus coherent c-ares, OpenLDAP, and tzdata
  updates; no new package, hook, downloader, telemetry, credential access, or
  unexpected runtime behavior was introduced.
• This is a confirmed security update: PostgreSQL 18.6 fixes 28 vulnerabilities
  across supported releases, and c-ares also moves past its 2026 memory-
  corruption and denial-of-service advisories.

Compatibility verification

• docker compose -f docker-compose.dev.yaml config --quiet — passed
• GitHub's Go 1.26/1.27 × PostgreSQL 16/17/18 matrix is green. The Go 1.27 /
  PostgreSQL 18 job pulled current postgres:18 and completed the database
  creation, migrations, and race-enabled test suite successfully.
• The exact Alpine pin could not be run locally because no Docker daemon is
  available. The image config, init scripts, SBOM/provenance, and upstream
  18.6 CI service provide the compensating evidence.
• The River Pro image failure is the queue-wide Dependabot AWS credential
  failure and is unrelated to this compose-only change.

Residual risk

• Low: embedded provenance is digest-bound but not independently Cosign signed
  and declares the build non-reproducible. Common-platform SBOMs were fully
  compared; uncommon-architecture payloads and the large upstream PostgreSQL
  source delta were not line-audited exhaustively. Deployments using custom
  logical decoding, affected GIN/btree_gist/ltree indexes, or legacy
  pgcrypto ciphertext should follow PostgreSQL 18.6's release notes.