agent-platform release v4.106.0

The agent-manager migrate run no longer races its network policy or stalls the connectivity upgrade (giantswarm/agent-platform#378). The connectivity chart rendered agent-manager-migrate-<hash> as a Job of the release: Helm applies the CRD-backed CiliumNetworkPolicy that gives it egress after the Job, so on a cluster with Cilium policyEnforcementMode: always the pod reached nothing and exhausted its retries, and a Failed Job stalled every upgrade (failed early due to stalled resources) — Helm’s readiness check reads a Failed Job as Failed with or without disableWaitForJobs. The release now carries the suspended CronJob agent-manager-migrate (never scheduled, always Current) and a post-install,post-upgrade hook that, as the tenant identity in the kagent namespace under the migration’s own policy, creates the run agent-manager-migrate-<hash> from it once the release’s manifests are applied, unless a run of that hash exists. The hook ends before the run does, so a failed migration leaves the release Ready and shows in its Job, its log and the agent-manager-migrate-report ConfigMap. A re-run is kubectl create job --from=cronjob/… (UPGRADE.md). make verify-migration asserts, in both network policy flavours, no Job of the release, the suspended CronJob, the start hook’s events, identity, policy label and script, and the run’s policy as a regular object.