chore(deps): keep PostgreSQL majors out of the update stream

The compose ecosystem added last change did its job on the first run and
immediately proposed 16.15 to 18.6. A PostgreSQL major changes the
on-disk format, so merging that would hand self-hosters a container that
cannot read their data directory without pg_upgrade or a dump and
restore. Minor releases keep arriving as reviewable PRs; a major is a
project decision with a migration path behind it, not a weekly bump.

The guard grows a case for the ignore rule, so dropping it fails rather
than quietly re-opening the door.

.github/dependabot.yml

@@ -38,3 +38,12 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 3
+    ignore:
+      # A PostgreSQL major is a migration, not an update: the on-disk format
+      # changes, so the operator has to run pg_upgrade or dump and restore.
+      # The first run of this ecosystem proposed 16.15 -> 18.6, which would
+      # have handed self-hosters a database their data directory cannot be
+      # read by. Minor releases still arrive as PRs; a major is a deliberate
+      # project decision with a migration guide behind it.
+      - dependency-name: "postgres"
+        update-types: ["version-update:semver-major"]