agent-platform release v4.28.4

The agentgateway controller admits xDS from every data plane of its GatewayClass, in any namespace (giantswarm/agent-platform#495): its ingress policy (both flavours) selected only the platform edge’s data plane by Gateway name in the release namespace, so the serving slice’s models Gateway in org-<org> connected to nothing — on gazelle its data plane was denied at 9978 (Policy denied DROPPED) and restarted by its startup probe forever. A second peer selects gateway.networking.k8s.io/gateway-class-name with the namespace label present, on 9978 only.