agent-platform release v3.22.0

gitops.forbidPinnedLoginConnector (default false): with true the render fails when muster.muster.oauth.server.dex.connectorId is set, naming the key. A pinned connector makes muster (through mcp-oauth) append connector_id to every Dex authorization request, so Dex’s connector chooser never appears; on an installation whose Dex serves several identity providers — the operator’s and the tenant’s — the pin hides every other connector, and people from those providers either cannot sign in to muster or, when the pinned connector is not the provider their MCP-server allowlists (allowedGroups, RBAC) are written for, receive a token without those groups. Backstage and the kagent UI leave the choice to Dex; the knob lets a fleet template hold muster to the same rule against a per-installation override, at render time and with the same shape as gitops.forbidInlineSecrets. Meta-package plumbing: not forwarded to the muster release. No installation needs to act: off by default, every render is unchanged. make verify-login-connector asserts the four cases (default renders and forwards a pin; on plus a pin fails naming the key and never repeating the value; on plus an empty or absent key renders; the knob reaches no child release).