fix(cli): consume AGENT_GATEWAY_ROOT_CERTIFICATES in deploy Dockerfile

[claxman]

Please ensure you have read the contribution guide before creating a pull request.

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: Dockerfile from "adk deploy agent_engine" ignores "AGENT_GATEWAY_ROOT_CERTIFICATES" build arg, causing runtime SSL handshake failures #6427

Problem:
_DOCKERFILE_TEMPLATE in cli_deploy.py never declares AGENT_GATEWAY_ROOT_CERTIFICATES (rg AGENT_GATEWAY_ROOT_CERTIFICATES src/google/adk/cli/cli_deploy.py on upstream/main prints nothing). Cloud Build passes that build-arg for Agent Gateway TLS interception and warns it was not consumed; the reporter's aiohttp path then fails with CERTIFICATE_VERIFY_FAILED.

Solution:
Re-lands #6428 by @Solaris-star, which was closed 2026-08-12 without merging (gh pr view 6428 --json state,mergedAt -> CLOSED / null). Same ARG plus update-ca-certificates RUN, rebased onto main and placed after adduser, before USER myuser. Empty arg is a no-op.

This installs the CA into the system OpenSSL store, which the aiohttp path in the issue reads. Clients pinned to certifi (httpx, requests) or gRPC bundled roots would still need SSL_CERT_FILE / REQUESTS_CA_BUNDLE / GRPC_DEFAULT_SSL_ROOTS_FILE_PATH. Those change trust for every deploy, so they are out of scope here.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

PYTHONPATH=src .venv/bin/python -m pytest -q tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py

17 passed in 0.22s.

With src/google/adk/cli/cli_deploy.py reverted to b018062 (git checkout b0180620 -- src/google/adk/cli/cli_deploy.py), same command: 5 failed (test_dockerfile_template_consumes_agent_gateway_root_certificates and all 4 test_to_cloud_run_happy_path params, on the ARG assertion), 12 passed. Restored: 17 passed.

Manual End-to-End (E2E) Tests:

Not re-run here (needs Cloud Build and an Agent Gateway). KenTandrian tested the same snippet via #6428: #6427 (comment)

Additional context

Claimed on the issue: #6427 (comment)

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.