agent-platform release v4.28.12

Fixed

• klaus-gateway reaches the kube-apiserver for its team-review endpoint on the bolt link store (giantswarm/agent-platform#511; towards giantswarm/klaus-gateway#273): klaus-gateway >= 1.11.0 verifies every caller of POST /reviews and POST /notices with an authentication.k8s.io/v1 TokenReview, but the connectivity chart granted the gateway pod the kube-apiserver entity only for the Secret link store (klausGateway.obo.store: secret with OBO on), so an installation that keeps its links in the bolt store and turns klausGateway.reviews.enabled on had no rule to the API server in its Cilium default-deny egress — every TokenReview timed out and the endpoint answered 503 to every caller (the OBO policy’s world/cluster :443 allowance never reaches the API server, which Cilium’s socket-LB resolves to the control plane before the policy applies). agent-platform.klausGateway.apiServerEgress is truthy also while klausGateway.reviews.enabled is true, so -klausgateway-store-egress carries toEntities: [kube-apiserver] (cilium) or the networkPolicy.kubernetes.apiServerCIDR ipBlock (kubernetes) whatever the link store — one rule, rendered once next to the Secret store’s. The connectivity chart declares klausGateway.reviews with the klaus-gateway chart’s defaults (enabled: false, audience: klaus-gateway, allowedCallers: []); the default shape renders byte-identically. make verify-klausgateway-netpol holds the rule on the bolt store in both flavours, its absence with reviews off, and that reviews next to the Secret store render the rule once; ci/test-klausgateway-reviews-values.yaml lints the shape. Lab-verified in agentlab with the connectivity chart of the PR: the in-cluster gateway with reviews.enabled and an allow-list answered POST /notices from the allowed ServiceAccount with 201 and from a ServiceAccount outside the list with 403.