agent-platform release v4.10.3

The Substrate line re-pins to v0.0.27-gs.9, the kagent line to v0.11.0-gs.12 (giantswarm/giantswarm#37773): components.substrate / components.substrate-crds move to >=0.0.27-gs.9 <0.0.28-0, components.kagent / components.kagent-crds to >=0.11.0-gs.12 <0.11.1-0 — the kagent release whose chart stamps the 0.0.27-gs.9 worker image, where the gVisor worker’s terminate collects a workload whose runsc containers are already gone (giantswarm/substrate#30). Before it, an AgentTemplate changed while its previous golden boot was crash-looping left the superseded revision uncollectable — failed to collect runtime revision … runsc state: exit status 128 every minute per template — and its golden actor pinned one worker of the pool for good (gazelle 2026-09-13: two of four). Proven in agentlab on the fork’s dev build: on 0.0.27-gs.7 the superseded revision was never collected in 56 minutes; on the patch the sweep after the template change collected it and freed the worker. The WorkerPool rolls once with the kagent release, which by itself frees the workers an installation on 4.10.x has pinned. UPGRADE.md carries the recognition and the by-hand recipe (delete the hosting worker pod) for a Substrate release before gs.9. BOM, tests/verify-components.py and tests/verify-kagent-crds.py follow the pins.