agent-platform release v4.108.0

README “Private skill repositories”: the credential contract of the kagent API v2 line (giantswarm/agent-platform#369). The credential is per source on the AgentTemplate (skills[].source.git.credentialRef), a Secret next to the template, never on the platform Harness: who provisions it, its shape (base64("<username>:<token>"), sent by the egress gateway as Authorization: Basic), rotation, the conditions a missing Secret or a wrong token leave, and where the token is visible (the Secret, Substrate’s credential provider and egress gateway; not the ActorTemplate, the actor or the snapshots). make verify-kagent-crds asserts the pinned AgentTemplate CRD serves skills[]/plugins[].source.git.credentialRef.

make verify-kagent-crds validates against the CRDs the platform installs, and kagent.modelConfigs[] takes the Mistral provider (giantswarm/agent-platform#369). The verify read the kagent line’s CRDs at a hard-coded v1.0.0 while components.kagent-crds installs >=1.2.0, so the re-pin onto 1.2 never met its sweep of the provider enum, and the 1.2 ModelConfig’s eleventh provider was refused by the render naming ten. The verify now reads its release from the floor of components.kagent-crds.versionRange; the chart accepts Mistral and renders its baseUrl under spec.mistral.