docs: make the comix DNS-hijack note resolver-conditional, not machine-local

The note read as a repo-wide fact ('this dev machine', 'here'), which is
meaningless in a clone elsewhere and invites adding --add-host
unconditionally. Now: symptom (ERR_CERT_COMMON_NAME_INVALID), the check
(getent hosts inside the container), the workaround, and an explicit warning
not to bake the hosts into chrome/docker-compose.yml.

AGENTS.md

@@ -51,10 +51,14 @@ Live CDP proof (needs that browser and network, skipped otherwise):
 `SMOKE_BROWSER_WS_URL=ws://<ip>:<port> go test -run 'TestSmokeKagane|TestSmokeComix' ./internal/latest`
 — fetches a real kagane and comix cover and chapter list. A red run means the challenge is
 not clearing from this IP, which is a live fact to re-check, not necessarily a defect.
-Note for this dev machine: comix.to is DNS-hijacked to an ISP block page here
-(`comix.to` CNAMEs to `aduankonten.id`, so Chrome fails `ERR_CERT_COMMON_NAME_INVALID`).
-Run the browser container with `--add-host comix.to:<cloudflare-ip> --add-host static.comix.to:<same>`
-resolved over DoH to get a real reading.
+A red `TestSmokeComix` reporting `ERR_CERT_COMMON_NAME_INVALID` is not the
+challenge: it means the resolver the browser container uses hijacks `comix.to`.
+Observed 2026-08-16 on one Indonesian ISP, which CNAMEs it to a block page
+(`aduankonten.id`). Check with `docker exec <browser> getent hosts comix.to`,
+and if it is hijacked, run the container with
+`--add-host comix.to:<ip> --add-host static.comix.to:<ip>` from a DoH lookup
+(`curl -H 'accept: application/dns-json' 'https://1.1.1.1/dns-query?name=comix.to&type=A'`).
+Machine-local, so don't put those hosts in `chrome/docker-compose.yml`.
 
 Smoke test: `curl` endpoints with `Authorization: Bearer <token>`; confirm `OPTIONS` preflight return CORS headers and `/healthz` return 200.