agent-platform release v4.42.1

Fixed

• The LLM listener attributes a kagent API v2 agent’s model calls to the agent, not to the Substrate egress (giantswarm/agent-platform#586). gateway.metricLabels’ agent and agent_namespace were the source workload resolved by IP (source.unverifiedWorkload.serviceAccount / .namespace), the shape of kagent 0.10 — one Deployment and one ServiceAccount per agent. Under kagent API v2 an agent is an AgentTemplate executed as a Substrate actor in the shared WorkerPool, and every actor connection leaves the worker as a mTLS CONNECT through the Substrate egress (atenet-egress), which authenticates the actor at CONNECT time and tunnels the bytes opaquely: by source IP every agent’s model call was the egress pod, every agent’s spend one row named after a proxy, and user unknown (actor traffic carries no bearer). The egress cannot add a header. The kagent runtime sends the identity on every model call as request headers — x-kagent-agent and x-kagent-agent-namespace (the template’s name and namespace) and x-kagent-user (the person of the turn) — and the three default expressions read them when, and only when, the source workload is the egress (agent-platform.substrate.egressCall: the namespace and ServiceAccount from the chart’s Substrate names, agent-platform.substrate.egressServiceAccount); every other caller keeps its own ServiceAccount, so no pod relabels itself by sending the header, and a call from the egress without the header reads unknown — the egress ServiceAccount itself appears in no new sample. The identity stays an accounting identity, never an authorization input. Mirrored in the meta chart. make verify-metric-labels asserts the three expressions with the predicate and the header names (parsed, since toYaml folds a long expression across lines), the person label’s hold and claim knob behind the predicate, an installation’s own expression replacing the default, and the meta chart forwarding the expressions unrendered; verify-target holds the old expressions equal on both sides of its golden comparison until origin/main carries this. README “Metric labels”. Installations act: none — the -metrics policy is re-rendered on the upgrade; the runtime half is the kagent line’s carried patch, and until an installation runs it the egress row reads unknown instead of the egress ServiceAccount.