agent-platform release v4.28.6

Changed

• klaus-gateway’s crd.install is no longer set by the meta chart, and the connectivity chart’s Kubernetes API egress for the gateway covers the Secret link store only (giantswarm/klaus-gateway#271). klaus-gateway drops the crd and configmap routing stores, the ChannelRoute CRD and the embedded controller, and its chart’s values.schema.json is closed (additionalProperties: false), so it refuses crd.* and controller.*. The meta chart forwards the whole klausGateway block to the klaus-gateway release (valuesFrom: klausGateway) and its defaults set klausGateway.crd.install: true, so that key has to go before the klaus-gateway release that drops it rolls: the component’s range >=1.10.0 <2.0.0 takes it with no PR, and a values file the schema refuses fails the Helm upgrade — the release sticks (the pods stay up). The current klaus-gateway chart defaults crd.install to true, so the render on the installations does not change: every installation’s klaus-gateway release gets one Helm revision (a values change) and no pod rolls. All three installations run klausGateway.routing.store: valkey and none sets crd or controller in its own patch. The connectivity chart follows: agent-platform.klausGateway.apiServerEgress is now the Secret link store’s gate alone (klausGateway.obo.store: secret with OBO on), so the -klausgateway-store-egress policy renders byte-identically for every shape an installation runs, and make verify-klausgateway-netpol no longer asserts the configmap / crd / controller.enabled gates.