agent-platform release v4.10.2

Fixed

• The cut-over Job’s egress admits the registry’s blob-storage front (giantswarm/agent-platform#433): the connectivity chart’s CiliumNetworkPolicy for the agent-manager migrate Job named api.github.com and the agent chart’s registry only; Azure Container Registry answers a chart blob GET with a redirect to *.blob.core.windows.net, which the policy dropped, so on gazelle’s cut-over (giantswarm/giantswarm#37746, connectivity 4.10.1) the Job logged agent chart registry unavailable … blob.core.windows.net … context deadline exceeded every 30 s and completed its expand phase with 0 release(s) rewritten … 8 pending — the portal-created agents stayed on chart 0.x until a hand-applied bridge policy and a clone of the Job (expand done (10 release(s) on 1.x values) within 30 s). The agent chart’s sources — the registry host, the storage front and GitHub (agentManager.networkPolicy.egress.fqdns, .cidrs) — now come from one helper for every pod that reads the chart, agent-platform.agentManager.chartSourcesEgress.<flavor>: agent-manager’s own egress and the Job’s policy render the same destinations in both flavours (the kubernetes flavour’s Job policy now also honours agentManager.networkPolicy.egress.cidrs the way agent-manager’s does, instead of opening every public destination regardless; agent-manager’s kubernetes egress is unchanged). make verify-migration asserts the Job’s policy admits the blob front and, knob by knob, exactly the FQDN and CIDR set agent-manager’s egress does in both flavours; UPGRADE.md names the redirect host next to the Job’s prerequisites. Render-verified only: agentlab has no Cilium (its kubernetes flavour already admitted the redirect), so the Cilium proof is gazelle’s bridge policy. Installations act: an installation whose Job already ran under 4.10.1 or earlier re-runs it per UPGRADE.md once this release is live — the pod template is unchanged, so the completed Job does not run again by itself; gazelle’s bridge policy agent-manager-migrate-acr-blob-cutover-bridge is removed once the release is live there.