agent-platform release v4.28.18

Fixed

• The meta chart’s forwarded values carry the Hugging Face download CDN pattern, and a mirrored egress list can no longer drift between the two charts (giantswarm/agent-platform#522, round 2; proof 1 of giantswarm/giantswarm#37639). #523 (4.28.17) added *.*.*.hf.co to the connectivity chart’s defaults only. The meta chart forwards its whole values tree to the connectivity release (templates/components.yaml, forwardAllValues), and a forwarded copy of a default shadows the child’s own, so an installation’s connectivity release still rendered the four old patterns from modelServing.networkPolicy.huggingFace.fqdns and modelManager.networkPolicy.huggingFace.fqdns of helm/agent-platform/values.yaml (gazelle 2026-09-17 04:30Z: Helm storage’s supplied .config with four entries beside the chart’s five; the three serving CNPs unchanged, the download would have been dropped exactly as before; caught before a model was loaded). Both meta lists gain *.*.*.hf.co, and the meta chart’s huggingFace and policies.env comments are the connectivity chart’s (the #520 rationale corrected in #523 was still the meta copy’s). Two checks hold the two charts together: make verify-meta (tests/verify-mirrored-values.py) asserts the meta chart’s copy of every networkPolicy fqdns / cidrs list equals the connectivity chart’s default, naming the path that differs, with a negative control (a list short of one entry fails, naming modelServing.networkPolicy.huggingFace.fqdns); make verify-model-serving-policies renders the connectivity chart a second time from the values the meta chart forwards to its release (the meta chart’s defaults, the model serving switch on) and matches the HUB_HOSTS fixture against those three CNPs too — the render an installation gets, not only the child’s defaults; against the previous meta values it fails naming us.aws.cdn.hf.co. The live half — the weights on the claim, the predictor Ready, /v1/chat/completions answering — is the proof’s.