agent-platform release v4.103.1

components.substrate{,-crds}.versionRange is >=1.2.0 <1.3.0: the Substrate line’s 1.2.0 takes substrate.atenetEgress.upstreamTrust.caBundle (giantswarm/agentlab#284). The egress gateway dials an actor’s upstream with its image’s public roots only, so a model or tool endpoint behind a private CA answered every call with 503 (invalid peer certificate: UnknownIssuer). With a PEM bundle in caBundle, the gateway trusts the public roots plus the bundle (giantswarm/substrate#92). Empty, the default, the egress gateway renders unchanged. 1.2.0 also carries otlploggrpc v0.21.0 for GO-2026-6508 (giantswarm/substrate#93) and keeps the durable pause copy out of external_snapshot (giantswarm/substrate#90). It is a patch of the line on kagent-dev/substrate v0.2.0-beta5, released as a minor, so the next re-pin is 1.3.0. The kagent WorkerPool’s worker image follows the floor to ateom-gvisor:1.2.0.