agent-platform release v4.28.5

Fixed

• The serving predictors pass the fleet’s restricted Pod Security Standard (giantswarm/agent-platform#498): a PolicyException model-serving-predictors in kyvernoPolicies.policyExceptionNamespace names the four rules the llmisvc controller’s predictor violates (the upstream vLLM image and its cache init container run as root: require-drop-all, privilege-escalation, run-as-non-root, check-seccomp-strict, with their autogen copies) for the serving namespace’s predictor Pods, ReplicaSets and Deployments — on gazelle the first LLMInferenceService’s Deployment was denied at admission and no model could be served.