agent-platform release v4.138.0

tenants.organizations.enabled also turns on agent-manager’s tenant reconciler (giantswarm/agent-platform#1044). With agent-manager on, its release gets tenants.enabled: true (it starts with --multi-tenant), the kagent namespace’s default ModelConfig default-model-config with its key Secret (kagent.providers.<default>.apiKeySecretRef), the workers’ network policy (substrate-workers on Cilium, substrate-workers-ingress on the kubernetes flavor, none with networkPolicy.enabled off) and 1 warm worker for each tenant that holds an agent as tenants.workerPoolReplicas (agent-manager.tenants.workerPoolReplicas overrides it). The render fails, naming the key, with an agent-manager range below 2.1.0, kagent off, agent-manager’s OAuth or downstream OAuth off, an empty kagent.fluxServiceAccountName, a default provider without apiKeySecretRef, or agent-manager.tenants.enabled set against the switch. Off, agent-manager’s values do not change. make verify-tenant-reconciler.

make verify-flux-crds, verify-substrate-store, verify-wiring and verify-metric-labels pass on macOS too. Their recipes no longer need GNU sed -i, GNU sed’s 0,/re/ address, grep -P or an unpadded wc -l, so they run with the BSD tools of a Mac as on CI. They check the same things.