agent-platform release v3.16.0

Added

• The cluster-shape knobs default to auto and render by served API group (roadmap#4348, PRD Q4): kyvernoPolicies.enabled renders the Kyverno objects when kyverno.io/v1 is served; networkPolicy.flavor is cilium when cilium.io/v2 is served, else kubernetes; global.observability.metrics.serviceMonitor.enabled renders the monitor objects when monitoring.coreos.com/v1 is served; dicebear.route.enabled (an Envoy HTTPRouteFilter user) follows gateway.envoyproxy.io/v1alpha1; agentSandbox.podSecurity.enabled (a Kyverno mutate policy) follows the resolved kyvernoPolicies.enabled. The meta chart detects once, from .Capabilities.APIVersions (live under helm-controller, the Helm CLI and --dry-run=server; Helm’s built-in set under helm template, so an offline render without --api-versions yields the vanilla shape), resolves every knob before it inlines a component’s values, and derives the component-level copies from the same answers while they are left at auto: muster.networkPolicy.flavor, muster.muster.observability.metrics.prometheus.serviceMonitor.enabled / .prometheusRule.enabled, muster.muster.observability.grafanaDashboard.enabled, valkey.ciliumNetworkPolicy.enabled, valkey.valkey.metrics.podMonitor.enabled (written false only where monitors are off), kagent.otel.tracing.enabled / .logging.enabled, kagent.oauth2-proxy.metrics.serviceMonitor.enabled and the OTEL_EXPORTER_OTLP_HEADERS entry of kagent.controller.env (dropped when both OTel exporters are off). The connectivity chart carries the same defaults and the same resolution helpers (agent-platform.shape.*) for renders on its own; under the meta chart it receives resolved values, so the two cannot disagree on one cluster. Explicit true / false (cilium / kubernetes) values keep winning, on a knob and on a component copy; the schema accepts auto|true|false (auto|cilium|kubernetes) and rejects anything else; the connectivity chart’s .Capabilities guards for the Flux and KServe APIs stay hard failures. make verify-auto (in CI) asserts the resolution per shape, the byte-identical fleet render, the vanilla shape and the overrides. No installation needs to act: with the fleet’s API groups served the render is byte-identical to before; a kind or plain cloud cluster renders the vanilla shape from the same chart without a values file that describes it.