agent-platform release v4.126.0

components.kagent{,-crds}.versionRange is >=1.8.0 <1.9.0 (was >=1.7.0 <1.8.0), and the customer BOM pins kagent 1.8.0. kagent 1.8.0 is built against the same Substrate 1.7 as 1.7.0 (components.substrate{,-crds}.versionRange stays >=1.7.0 <1.8.0; the WorkerPool’s worker image stays ateom-gvisor:1.7.0), and its CRDs are unchanged, so the controller, UI and Harness images roll in place. A Session’s egress policy is compiled without the template’s artifact credentials (giantswarm/kagent-upstream#286): the credential goes with the golden boot’s fetch only, never with a session’s requests. A new Actor’s inherited template allowlist is replaced instead of merged, and the execute path no longer writes dead revisions.