agent-platform release v4.28.0

Added

• modelManager.networkPolicy.registeredBackends: the egress an installation allows for backends registered at runtime (giantswarm/agent-platform#478; follows #329; bumblebee-plans#46 D3/D4/D5/D7; epic giantswarm/giantswarm#37639). model-manager starts with no backend (#329) and a backend — an in-cluster Ollama on :11434, an LM Studio on a node address, a Lemonade Server — is registered while it runs, as a labelled ConfigMap the chart never sees; the connectivity chart’s egress policy for model-manager is rendered from the static backend inputs, so it did not open the registered one: under the cilium flavour add_backend succeeded, the backend showed on the Serving page and every model call was dropped, and the kubernetes flavour opened 443 only (modelManager.networkPolicy.egress.cidrs too). The new list — {cidr, port} and {fqdn, port} entries — renders one more egress rule per entry on its port in both flavours, after the static-backend rules (unchanged): toCIDR / ipBlock for a block, toFQDNs plus the cluster entity for a name (the cilium flavour only, exactly as the static hostname rule — so an in-cluster Service is listed by name there, Cilium’s CIDR rules matching neither pods nor nodes). Empty by default, the default render is byte-identical. Guards fail the render on a cidr that is not an IPv4 CIDR, a missing or non-TCP port, an entry with both or neither destination, an fqdn that is not a hostname, and an fqdn under the kubernetes flavour with policies on, naming the cilium flavour. make verify-managers asserts the rule in both flavours, the untouched default and every guard; UPGRADE.md tells an operator with an enforcing policy to list a backend’s destination when registering it.