agent-platform release v3.3.0

Added

• Two components, off by default: components.model-manager (model-manager, model inventory / pull / load / unload / delete and kagent ModelConfig wiring on an Ollama or KServe backend) and components.agent-manager (agent-manager, the agent write surface: kagent agents as Flux HelmReleases of the agent chart), each as REST and MCP through muster’s own MCPServer CR and each acting as the user (OAuth 2.1 resource server, forwarded id_tokens, downstream OAuth to the Kubernetes API, no ServiceAccount RBAC). The model-manager: / agent-manager: blocks are forwarded to the component releases; the modelManager: / agentManager: blocks drive the wiring the connectivity chart renders for them — the agentgateway route and JWT policy (route.*, the kagent controller route’s shape), the network policies in both flavors (ingress from the data plane, muster and the kubelet’s probes; egress to DNS, the Kubernetes API, the identity provider, the Ollama endpoint or the Hugging Face Hub, the agent chart’s registry and GitHub) and render-time guards (backend, endpoint, KServe and Flux APIs, kagent on and same namespace, muster for the MCPServer CR, the OAuth inputs, route mode / hostname / parentRef / JWKS egress). make verify-managers covers them; examples/customer-bom.yaml pins both. No installation needs to act: both components are off and the default render is unchanged.
• agent-platform.dnsEgressWithProxy, agent-platform.urlHost and agent-platform.idpEgress.cilium helpers in the connectivity chart: a DNS egress rule with Cilium’s proxy clause for policies that select destinations by name, and the egress a platform service needs to reach the login identity provider (by name on 443, plus the cluster entity on 443/10443 for an issuer behind an in-cluster Gateway).