agent-platform release v3.20.1

The shared RemoteMCPServer agent-platform/muster reported Accepted=False (ReconcileFailed … Unauthorized) on every installation: the kagent controller lists a server’s tools with its own request, which carries no bearer, and muster (an OAuth resource server) answers 401 (#299). While muster runs with OAuth on (muster.muster.oauth.server.enabled, the default) the connectivity chart now labels the CR kagent.dev/discovery: disabled, the opt-out from controller-side tool discovery contributed upstream (kagent-dev/kagent#2752, 0.10.x backport kagent-dev/kagent#2753): a controller that knows the label reports Accepted=True (DiscoveryDisabled, empty inventory); an older one ignores the label and behaves as before. Agents are unaffected — they resolve tools at run time as the caller. A controller credential through spec.headersFrom was rejected on purpose: the kagent runtime applies static headers after the propagated caller token, so every agent would have acted as the controller’s ServiceAccount (docs/authentication.md, “Tool discovery by the kagent controller”). make verify-kagent-discovery asserts the label follows the OAuth toggle and stays off the operator-defined kagent.remoteMcpServers.