agent-platform release v4.123.0

The agent-manager migrate CronJob bounds its emptyDir (giantswarm/agent-platform#866). The suspended CronJob every migrate run is created from mounted /tmp as an emptyDir without ephemeral-storage requests and limits, which Kyverno’s require-emptydir-requests-and-limits reported; #780 had bounded the hook Jobs only. The migrate container now requests 16Mi and is limited to 256Mi of ephemeral-storage and /tmp carries 256Mi as its sizeLimit, the hook Jobs’ values. The change is in the run’s pod template, so its hash and with it the run’s name change: the next upgrade starts migrate once more on every installation with migration on. The command is idempotent (a release already on the target values is left unchanged, a run that finds nothing left writes only its report), so the rerun rewrites nothing that is already migrated. make verify-hooks-ephemeral-storage asserts the CronJob next to the hook Jobs.