agent-platform release v4.22.0

Added

• One release of this chart per target cluster: the target kubeconfig knob, enabled for muster and dicebear, one owner per cluster-scoped component, the slice fixtures (giantswarm/agent-platform#328; bumblebee-plans#46, epic giantswarm/giantswarm#37639). The serving slice (#326) and the runtime slice (#317) are values profiles cluster-manager installs as one <cluster>-agent-platform release per target cluster, the slices as toggles in its values — beside the platform’s own release on the installation’s cluster, or onto a workload cluster that runs no Flux. Three things in the chart stood in the way. New: gitops.target.kubeConfig.secretRef (name, key) — when set, every component HelmRelease the loop renders carries spec.kubeConfig.secretRef verbatim (the connectivity release included), the field shape the fleet installs every workload-cluster app with, so the installation’s helm-controller installs each component into the target from the OCIRepositories in the release namespace, dependsOn intact, the connectivity chart’s lookup guards evaluated against the target; unset, the render is byte-identical to before; refused with the bundled engine on (agent-platform.validateTarget — no Flux is installed into a workload cluster or into a cluster that runs one), and no Helm hook renders with it (the kagent storage-version pair would run against the installation’s CRDs). components.muster.enabled and components.dicebear.enabled (default true; the two were force-on) — off renders no release of theirs and the roster tells the connectivity chart, which now drops every reference: muster’s /mcp HTTPRoute, the -mcp-egress policy, the agentgateway data-plane and controller rules, the kagent controller and Substrate rules that select muster’s pods (the managers’ already read the roster); the avatars host in the portal’s CSP. components.<name>.ownedCrds — a CRD the component installs that already exists and whose Flux labels (helm.toolkit.fluxcd.io/name, /namespace, which helm-controller stamps on every object of a release, crds/ included) name another HelmRelease fails the render naming the release to remove first (agent-platform.validateCrdOwners; agentgateway, kserve-crd, kserve-llmisvc-crd, kagent-crds and muster carry one representative CRD each; skipped with the target knob, where the lookups see the installation; a CRD without the labels is left to Helm as before). make verify-target (tests/verify-target.py) asserts the offline half: the stamp and the byte-identity of five renders against origin/main, the toggles on both charts, the engine guard, the hooks, and the serving- and runtime-shaped toggle sets (ci/test-slice-serving-values.yaml, ci/test-slice-runtime-values.yaml, ci/test-target-values.yaml — the profiles themselves are #326’s and #317’s) alone, combined (the union; the first slice’s documents unchanged when the second is switched on — an in-place upgrade) and targeted, agentgateway off beside the platform’s release and on for a workload cluster; the two lookup guards are asserted on a cluster (README, “One release per target cluster”). Default render unchanged.