agent-platform release v4.26.0

Added

• components.cluster-manager: the Agent Platform’s cluster write surface as a chart component, off by default (giantswarm/agent-platform#316; giantswarm/giantswarm#37637; bumblebee-plans#42 and #46; epic giantswarm/giantswarm#37639). One OCIRepository + HelmRelease of the catalog’s cluster-manager chart (>=0.4.2 <1.0.0, dependsOn: [muster] — the floor is the first release that tolerates a cluster without the Cluster API group: list_clusters answers an empty list with a note, a dry run on a cluster that does not exist is refused naming it, get_info reports clusterApi and the real version) in model-manager’s mold: the cluster-manager: block forwarded verbatim — the pinned Service name, the OAuth 2.1 resource server acting as the caller (oauth.downstream), the chart’s own MCPServer CR with forwardToken and the dex-k8s-authenticator audience the kube-apiserver trusts, so muster registers x_cluster-manager_* and the portal’s Clusters pages call the tools through muster as the signed-in user (MCP is its only surface: no route, no JWT policy, no proxy entry) — with global.* injected and modelManager.namespace derived from the platform’s own namespace (an own value must agree). The connectivity chart renders the wiring from the clusterManager: block: network policies in both flavors (ingress from muster and the kubelet’s probes; egress to DNS, this installation’s Kubernetes API, the identity provider, the workload clusters’ API servers — clusterManager.networkPolicy.workloadClusters: names, addresses, ports: [443, 6443] — and clusterManager.networkPolicy.egress on 443) and the render-time guards (muster off with the MCPServer on, a missing identity input, a bad CIDR, an empty port list, clusterManager.flux.requireApi). The two blocks travel to the connectivity release only while the component is on (gatedValues, vm-manager’s shape); the default render is unchanged but for the roster entry. examples/customer-bom.yaml pins 0.4.2; make verify-cluster-manager (tests/verify-cluster-manager.py) covers all of it; README “Cluster manager”. The flip to default-on is a decision for after the first lab proof.