agent-platform release v4.10.1

Added

• The platform’s single-replica pods refuse voluntary disruption (giantswarm/agent-platform#431; on graveler a Karpenter consolidation evicted the agentgateway data plane mid-turn). karpenter.sh/do-not-disrupt: "true" on the pods that carry live streams — the agentgateway data plane (gateway.parameters.podAnnotations, merged onto the pod template through AgentgatewayParameters by the connectivity chart), muster (muster.podAnnotations), the kagent controller (kagent.controller.podAnnotations) and klaus-gateway (klausGateway.podAnnotations) — and a PodDisruptionBudget minAvailable: 1 on muster (muster.podDisruptionBudget, the muster chart’s knob), the kagent controller (kagent.controller.pdb with maxUnavailable: "" and unhealthyPodEvictionPolicy: AlwaysAllow, the kagent chart’s knob), klaus-gateway (klausGateway.podDisruptionBudget, the klaus-gateway chart’s knob, 1.1.0+) and agent-manager (agentManager.podDisruptionBudget, rendered by the connectivity chart as PodDisruptionBudget agent-manager in the release namespace; exactly one of minAvailable / maxUnavailable, the render refuses both, neither and a policy outside the API’s enum). Every knob is on by default and enabled: false / a "false" annotation opts out. Every installation rolls the four annotated pods once; the budgets make Karpenter report DisruptionBlocked and a node drain wait for its drain timeout on these pods — UPGRADE.md. make verify-disruption asserts the render, the knobs off and the guards.