agent-platform release v4.28.13

make live-serving-slice reads the controller’s jwks-store in the shape the controller writes it (giantswarm/agent-platform#515; proof 1 of giantswarm/giantswarm#37639): tests/verify-serving-slice-live.py asserted a positive nkeys on the jwks-store-<hash> entry, a field the store has never had — the entry is {requestKey, url, fetchedAt, jwks} as the controller’s jwks package persists it, jwks the fetched JWKS document as a JSON string — so against a healthy controller (gazelle 2026-09-16 23:41Z: models-jwt Accepted=Valid, two keys for the in-cluster Dex including the token’s kid) the one live signal #505 introduced failed. The check now parses jwks and counts its keys, printing their kids (a 401 token uses the unknown key "<kid>" names the one to compare with), fails naming the URL on an empty set as before, and fails naming the ConfigMap when jwks is not a JWKS document; the policy’s Accepted.reason stays the primary signal. make verify-serving-slice-store (tests/verify-serving-slice-store.py) holds the reader over tests/fixtures/jwks-store-configmaps.json, a copied store in the writer’s shape (names and request keys derived as the controller derives them: the issuer with two keys, an issuer with an empty set, a labelled ConfigMap without the entry) with kubectl stubbed — pass, empty set, unknown URL, malformed document; verify-all runs it.