agent-platform release v4.5.1

Fixed

• The kagent line re-pins to v0.11.0-gs.2 (giantswarm/giantswarm#37010, giantswarm/agent-platform#345 criterion 5). The line’s first release v0.11.0-gs.1 (commit 0ac5240) predated the two carried patches the platform depends on, so 4.0 shipped a controller image without them: the trusted-proxy authenticator (giantswarm/kagent-upstream#9 — the controller re-derives the caller from the bearer’s verified email claim instead of trusting X-User-Id) and helm.sh/resource-policy: keep on the five kagent-crds CRD templates (#10 — an uninstall no longer deletes the CRDs and every AgentTemplate/RemoteMCPServer with them). v0.11.0-gs.2 (commit 3bdff381) carries both. kagent.tag moves to 0.11.0-gs.2 (the controller and UI image build) and kagent.harness.image to the gs.2 Go ADK index digest (meta and connectivity charts); components.kagent/components.kagent-crds keep the range >=0.11.0-gs.1 <0.11.1-0 (a prerelease floor Masterminds admits gs.2 above). With the controller on gs.2, agent-platform#345 criterion 5 holds: reached directly, bypassing agentgateway, a request with a forged x-user-id is attributed to the bearer’s email, not the header (kagent.controller.auth.mode: trusted-proxy, userIdClaim: email, unchanged 4.0 defaults). Lab-proven on agentlab against the gs.2 build: a port-forward to kagent-controller, kagent.api.v1alpha1.SystemService/GetCurrentUser returned the admin bearer’s email while a forged x-user-id: someone-else@evil.test was ignored, a bearer-less call was refused (Unauthenticated), /health stayed 200, and the five CRDs carried helm.sh/resource-policy: keep. examples/customer-bom.yaml and tests/verify-kagent-crds.py (KAGENT_LINE_REF) move with the pin. No installation acts — the release stays inert behind the fleet’s <4.0.0 bound.