agent-platform release v4.134.0

Vertex AI with a service account key works under Cilium enforcement: Substrate’s credential provider reaches oauth2.googleapis.com:443 (giantswarm/agent-platform#1042). The provider exchanges an AnthropicVertexAI or GeminiVertexAI ModelConfig’s service account key for an access token itself, at the key’s token_uri, but substrate-k8s-credential-provider allowed only DNS and the apiserver, so every Vertex AI call failed with could not exchange the service account key for an access token. The policy now opens networkPolicy.substrate.credentialProvider.egressFQDNs on 443/TCP, with the DNS proxy rule that lets Cilium match the names; the default is oauth2.googleapis.com, the only token_uri kagent admits. A list of its own replaces the default; [] leaves the provider the apiserver and DNS only. The kubernetes flavour renders no egress policy and ignores it. make verify-kagent-netpol asserts the default, a list of its own and an empty one.