agent-platform release v4.42.0

Changed

• The kagent line’s images, the Substrate line’s images and the bundled Flux engine’s controllers come from their gsoci copies (giantswarm/agent-platform#580; the copies giantswarm/retagger#1229; epic giantswarm/giantswarm#37853). retagger copies every release of the two lines and every Flux controller of the 2.9+ line to gsoci.azurecr.io under the upstream path — giantswarm/kagent/{controller,ui,golang-adk,claude-harness}, giantswarm/substrate/{ateapi,atecontroller,atelet,atenet,podcertcontroller,ateom-gvisor}, giantswarm/fluxcd/{source-controller,helm-controller} — with the index digests preserved, so one registry value moves per line and everything the charts stamp stands: kagent.registry is gsoci.azurecr.io (the controller and UI at the chart’s tag, the Go ADK and Claude harness images at the digests the chart carries, the kagent-images ConfigMap Substrate’s image cache reads), substrate.image.registry is gsoci.azurecr.io/giantswarm/substrate (the control plane at the chart’s tag; the worker image the meta chart derives from the Substrate floor follows it, as does the helper’s default) and flux-engine.instance.distribution.registry is gsoci.azurecr.io/giantswarm/fluxcd (the operator composes <registry>/<controller>:<tag>; Flux 2.9.5’s source-controller:v1.9.5 and helm-controller:v1.6.4 under the pinned operator). The two lines’ chart sources stay on ghcr.io (components.kagent*.repository, components.substrate*.repository): retagger copies images, not charts, and the lines publish their release charts to gsoci through their own tag workflows once that lands — the three chart references (and the upstream CloudNativePG chart, behind a Giant Swarm wrapper release on the same operator line) are what make verify-images still tolerates by name. A dev build’s images are not copied: the dev channel sets kagent.registry: ghcr.io and substrate.image.registry: ghcr.io/giantswarm/substrate next to its filter (README “Dev channel”). verify-components, verify-worker-image, verify-kyverno and verify-engine assert the new defaults; verify-target holds them on both sides of the golden comparison until origin/main carries them. UPGRADE.md.