agent-platform release v4.133.2

components.substrate.versionRange and components.substrate-crds.versionRange are >=1.11.4 <1.12.0 (were >=1.11.3 <1.12.0), the kagent WorkerPool’s worker image follows to ateom-gvisor:1.11.4, and the customer BOM pins Substrate 1.11.4: a CONNECT tunnel ends when the actor closes its connection (giantswarm/agent-platform#1034). atunnel, which runs in the worker’s ateom, kept a tunnel open after the actor closed or reset its connection for as long as the router held its request stream, so a gRPC call to such an actor waited out the client’s deadline instead of failing at once (giantswarm/substrate#451). Same minor, same upstream pin, no persisted-format change: the kagent release is unchanged, and the step resets no snapshot and needs no manual step (UPGRADE.md).