agent-platform release v4.136.0

A Responses API ModelConfig for codex through the LLM listener (giantswarm/giantswarm#38551). The codex runtime speaks OpenAI’s Responses API only, and the listener’s ModelConfigs followed the first llmRouting.models entry’s provider alone, so a codex agent’s model calls went to the provider directly, unpriced and outside the rate limits. Every llmRouting.models provider now rides the listener: an OpenAI entry (baseURL: https://api.openai.com/v1, match: gpt-*) serves the Responses route the data plane classifies at /v1/responses, and a kagent.modelConfigs[] entry of that provider gets the listener URL with /v1, the base an OpenAI client appends /responses to. A new apiFormat key (chatCompletions or responses, OpenAI only, refused elsewhere naming the entry) sets openAI.apiFormat; with responses and no other OpenAI option the ModelConfig passes the codex compiler’s rules. The MutatingAdmissionPolicy renders once per served provider, so a codex ModelConfig agent-manager or Backstage creates rides the listener too (<release>-modelconfig-llm-routing-openai; the first provider’s keeps its name). llmRouting.rateLimits target the listener, so they cover the Responses route as every other. A codex call appears under its agent in the usage metrics once the codex runtime names its agent on its model calls (giantswarm/kagent-upstream#613); until then it reads unknown. make verify-llm-routing.