agent-platform release v4.19.3

Added

• make verify-all: every verify-* target of Makefile.custom.mk in one target, which is what CI runs. The list is read out of that file, so a new verify-* target reaches CI by existing and nothing names the set twice; make help lists what each one asserts. The test-ingress-modes job named all 37 of them on one line, which drifted from the Makefile on every addition.
• make e2e KUBECONFIG=… [SCENARIO=…] [CLUSTER_TYPE=…] [VALUES=…]: runs one ATS scenario against any cluster. It packages the chart and hands the suite its inputs. SCENARIO is the pytest marker (smoke or functional), CLUSTER_TYPE picks the scenario defaults (kind or eks), and VALUES replaces the scenario’s values-file list. E2E_DOMAIN, E2E_ISSUER_URL, E2E_CLIENT_ID and E2E_IDP_SECRET_NAME (the name of a Secret already on the cluster, not a credential) become a temporary values overlay layered last and removed on exit; tests/e2e_overlay.py renders it, and the target prints its line count, never a value. Each of those names one fact the chart and the tests both need, so the target derives the suite’s ATS_ISSUER_URL, ATS_CLIENT_ID, ATS_IDP_CA_SECRET and — on a cluster type other than kind — ATS_MUSTER_BASE_URL from them, and an ATS_ variable already in the environment wins. A KUBECONFIG with a leading ~ is expanded, which zsh does not do for an argument of that form. Documented in tests/ats/README.md.
• helm/agent-platform/examples/kind-lab-dex.yaml: the kind lab shape as a shipped example, moved from tests/test-values.yaml with its values unchanged (its header comment carries the install recipe and the no-secret statement). It is the file the ATS smoke installs, and test_the_scenario_installs_the_example_file asserts the scenario names an example file the repository ships. .ats/main.yaml and make verify-self’s lab-shape render follow the new path.

Changed

• The ATS suite takes its cluster-specific inputs from a Scenario (tests/ats/scenarios.py, one per cluster shape) instead of kind literals, so the same assertions run on any cluster. Five groups become fields, each with its own environment variable: the values files (ATS_VALUES, plus ATS_OVERLAY_VALUES layered last), the identity provider (ATS_ISSUER_URL, ATS_CLIENT_ID, ATS_CLIENT_SECRET, ATS_REGISTRATION_TOKEN, ATS_IDP_USER, ATS_IDP_PASSWORD, ATS_IDP_CA_SECRET), the OAuth redirect (ATS_OAUTH_CALLBACK), muster’s base URL and how it is reached (ATS_MUSTER_BASE_URL, ATS_MUSTER_REACH) and the budgets (ATS_INSTALL_TIMEOUT, ATS_UNINSTALL_TIMEOUT, ATS_UNINSTALL_BUDGET_S, ATS_READY_TIMEOUT_S). A port is read out of the URL that carries it, so the two can never disagree. ATS_CLUSTER_TYPE gains eks, whose scenario installs no lab Dex, port-forwards nothing and carries no default issuer, client, base URL or values file. An unknown cluster type, an unknown reach, a budget that is not an integer, a missing issuer, client or base URL, a values file that does not exist, and a non-kind scenario without ATS_VALUES, each fail the run with a message naming the variable. make verify-scenarios asserts the loader and the make e2e overlay offline. Every field defaults to the value it had, so ATS_CLUSTER_TYPE=kind with nothing else set installs the same three values files with the same ports, budgets and credentials.