agent-platform release v4.44.1

Changed

• The substrate chart’s third-party image defaults are pinned to their gsoci copies in the forwarded substrate.images block, and make verify-images sees a bare Docker Hub name (giantswarm/agent-platform#575, #580). The substrate release ran postgres:18-alpine@…, rustfs/rustfs:… and amazon/aws-cli:… from Docker Hub — short names whose registry is the node runtime’s call — and the atenet router’s and egress’s agentgateway from the line’s ghcr build: the chart’s own images: defaults, forwarded verbatim by a block that set none of them, so the check that holds every default to gsoci never saw them. substrate.images.{postgres,rustfs,agentgateway} now name the gsoci.azurecr.io/giantswarm/… copies at the same digest (postgres:18.4-alpine@… — the mirror carries Docker Hub’s floating 18-alpine digest under its own tag — rustfs:1.0.0-beta.3@…, agentgateway:v1.5.1-gs.4); images.awsCli is forwarded at the chart’s own short name on purpose — the rustfs-bucket-init Job is a release resource whose pod template is immutable, so a changed image fails the upgrade of every installation running the bundled store — and moves with the Substrate release whose Job can be recreated. tests/verify-images.py fails a string under a key named image, or an entry of a map or list named images, that is shaped like an image reference off gsoci — a bare name included — and tolerates the bucket-init image by name until then; the new make verify-substrate-images pulls every Substrate release the range admits and holds each pin to the release default’s digest or tag under gsoci, renders the release with the forwarded block and the bundled store on, and refuses a third-party image left off gsoci, so a Substrate re-pin that moves a default (another agentgateway build, a newer postgres) cannot leave the meta chart forwarding the old one. README “Agent Substrate”; UPGRADE.md.