agent-platform release v4.10.6

Fixed

• The s3proxy façade declares its ephemeral storage and bounds its emptyDirs (giantswarm/agent-platform#438; glean on connectivity 4.10.3 and 4.10.4, 2026-09-13). The substrate-s3proxy container mounts two emptyDirs (/tmp for the JVM, the image’s /data) and carried no ephemeral-storage requests or limits, so Kyverno’s require-emptydir-requests-and-limits (Audit on the fleet) reported Containers mounting emptyDir volumes must specify requests and limits for ephemeral-storage on every rollout — the one Kyverno finding the platform left on a fresh 4.x installation, and a refusal on a cluster that enforces the policy. kagent.harness.snapshotStore.s3proxy.resources now defaults requests.ephemeral-storage: 256Mi and limits.ephemeral-storage: 1Gi in both charts (the meta chart forwards the block; the façade streams, nothing of a snapshot lands on its disk), both emptyDirs take the limit as their sizeLimit, and the render refuses a resources block without either field, naming the key. make verify-substrate-store asserts the fields and the bound on the capz and the façade-alone shapes, the knob, the forwarded default and the guard; tests/verify-components.py holds the two charts’ resources defaults together. An installation with the façade rolls its two substrate-s3proxy pods once (a pod template change; the rolling update surges the new pod first) — UPGRADE.md. Lab proof (agentlab, the façade alone against Azurite, hack/agentlab/): a lab on connectivity 4.10.4 upgraded to this branch’s dev build rolled the façade in 6 s (new ReplicaSet, 2/2 Ready, old at 0) with ephemeral-storage 256Mi/1Gi and both emptyDirs sizeLimit: 1Gi on the live pods; an AgentTemplate created right after went Ready on the platform Harness in 5 s with its golden snapshot (5 objects, 1.3 MiB) written through the rolled façade into Azurite; agentlab platform-test all PASS before and after. The Kyverno half is fleet-only (agentlab runs no Kyverno): the acceptance is no require-emptydir-requests-and-limits event on glean once the release rolls.