Add age key

- Add AGE.md with policies
- Add age-recipient.txt for `age -R`
- Add ceremonies/2026-09-13_age_key.md as the signed record
  of which recipient is valid from which date
- List the recipient in KEYS.md
- Describe AGE.md and age-recipient.txt in README.md
- Extend the scripts:
  + sign.sh signs AGE.md by default
  + verify.sh verifies AGE.md by default
    and cross-checks age-recipient.txt,
    the only unsigned artifact,
    against the recipient in the signed KEYS.md and AGE.md

scripts/sign.sh

@@ -4,7 +4,7 @@
 #
 # Usage:  ./scripts/sign.sh [FILE...]
 #
-# FILE defaults to KEYS.md OPENPGP.md
+# FILE defaults to KEYS.md OPENPGP.md AGE.md
 #
 # Writes FILE.asc next to each FILE and verifies it
 
@@ -22,6 +22,7 @@ if [ $# -eq 0 ]; then
     set -- \
         "$REPO/KEYS.md" \
         "$REPO/OPENPGP.md" \
+        "$REPO/AGE.md" \
         # Keep this list aligned with the documentation at the top
 fi