agent-platform release v4.21.0

Changed

• The Substrate line moves to v0.0.30-gs.2: the worker pool can be spread over nodes and zones (giantswarm/agent-platform#472, second half; the carried patch giantswarm/giantswarm#37797, #37742 row 46). v0.0.30-gs.2 is the first release whose WorkerPool CRD carries spec.template.topologySpreadConstraints (an atomic list of at most 8) and spec.template.podAntiAffinity, mapped onto the worker pods next to nodeAffinity; every release before it pruned both at admission. components.substrate / components.substrate-crds move to >=0.0.30-gs.2 <0.0.31-0 and agent-platform.substrate.workerPoolSpreadFloor names the release, so the render guard of 4.20.0 now forwards kagent.substrateWorkerPool.template.topologySpreadConstraints / podAntiAffinity verbatim to the kagent release and the WorkerPool, and refuses them — naming the key, the floor and the range — only on an installation whose Substrate range floor is pinned below it. The worker image the kagent chart stamps stays ateom-gvisor:0.0.30-gs.1 (kagent 0.11.0-gs.14 on) and runs under the gs.2 control plane: the release changes ate-controller, the CRD and ate-api only, so the Substrate pin and the kagent pin part ways for the first time (values.yaml says when they move together: a re-pin that changes the runtime). The release also carries giantswarm/substrate#35 (a paused actor’s resume fails fast when its node is gone, LOCAL_SNAPSHOT_GONE, #37742 row 44a). The example BOM, tests/verify-components.py and make verify-workerpool follow the pin: the spread now reaches the kagent release at the floor and is refused below it, the two branches the test exercised with a temporary floor before. Every installation with kagent on rolls the Substrate control plane once (the CRDs gain the two fields, ate-api-server / ate-controller / atenet / atelet restart); the worker pods, the WorkerPool template and the goldens are untouched — UPGRADE.md.