agent-platform release v4.65.1

Fixed

• The Substrate floor is 1.0.2 and substrate.images.agentgateway the agentgateway line’s 2.1.1: the egress gateway’s client certificate follows its rotation (giantswarm/giantswarm#37915). atenet-egress and atenet-router authenticate to ate-api with the client certificate of a PodCertificate projected volume that kubelet rotates 30 minutes before its 24-hour expiry; agentgateway 2.0.0 read that file once, so a day after pod start every actor CONNECT was answered 403 Forbidden: actor identity check denied … CertificateExpired and every sandbox’s first outbound request was reset by peer — the Swarmgeist outage of 2026-09-23. The Substrate line’s 1.0.2 (its release-1.0 branch: 1.0.1 plus the pin and podCertificates.maxExpirationSeconds, unset by default) runs the agentgateway line’s 2.1.1, which re-reads a managed file resource on every fetch (giantswarm/agentgateway-upstream#20). components.substrate*.versionRange is >=1.0.2 <1.1.0: make verify-substrate-images checks the pin against every release the range admits, and 1.0.0 and 1.0.1 name 2.0.0; the BOM pin and the derived worker image follow, so the pool rolls once with the control plane. The agentgateway.controller.image and agentgateway.proxy.image of the platform’s own data planes are giantswarm/agent-platform#647’s. make verify-worker-image now admits a Substrate pin that leads the kagent build’s stamp by a patch of the same minor (kagent 1.0.1 is stamped against Substrate 1.0.0): a patch of the line changes no runtime contract, which is what the range shape >=X.Y.Z <X.(Y+1).0 already encodes, so a data-plane fix ships without a kagent rebuild; a stamp newer than the pin, or in another minor, still fails.