agent-platform release v4.10.4

The s3proxy façade authenticates to Azure Blob with Workload Identity (giantswarm/agent-platform#436; found on glean’s cut-over, 2026-09-13). With kagent.harness.snapshotStore.crossplane.provider: capz the connectivity chart left JCLOUDS_CREDENTIAL unset so that s3proxy would defer to DefaultAzureCredential — but the image (gaul/s3proxy 4.1.1) carries JCLOUDS_CREDENTIAL="remote-credential" as a Dockerfile default, and s3proxy takes the DefaultAzureCredential path only while the credential is empty: the façade signed every request as the account with that literal as the shared key and Azure’s SDK refused it on the base64 decode ('base64Key' was not a valid Base64 scheme … Illegal base64 character 2d on every PUT …/snapshots/…), so every golden boot crashed before its snapshot was taken. The capz branch now sets JCLOUDS_CREDENTIAL: "" explicitly next to AZURE_CLIENT_ID / AZURE_TENANT_ID; the account-key branch is unchanged. make verify-substrate-store asserts both shapes. Live proof on glean: with the variable empty the golden snapshot of sre-agent landed in giantswarm-glean-substrate through the façade on the next boot (Workload Identity end to end, the half agentlab cannot exercise — its façade proof runs the account-key branch against Azurite).