agent-platform release v4.65.3

The Substrate floor is 1.0.3 and substrate.images.agentgateway the agentgateway line’s 2.1.2: the gateways’ client certificates follow their rotation whatever order kubelet writes a pod’s bundles in (giantswarm/giantswarm#37915). 2.1.1 re-read a managed file on every fetch, but the certificate files a Substrate policy’s policies.backendTLS names are read at parse time and were never managed, so a rotation reached substrateEgressActorResolution and substrateIngress only when another resource’s event reloaded the config after the podidentity bundle was on disk — the egress pod when kubelet wrote both bundles in one sync, the router by the cadence of its servicedns rotation. 2.1.2 registers those files as managed dependencies, watched and re-read every 60 s (giantswarm/agentgateway-upstream#23). Substrate 1.0.3 (release-1.0) pins it; components.substrate*.versionRange is >=1.0.3 <1.1.0, the BOM pin and the derived worker image follow, and the gateway pods roll once onto the new data plane. The platform’s own controller and data planes move with it: agentgateway.controller.image.tag and agentgateway.proxy.image.tag are 2.1.2 in both charts (the packaging chart’s 2.7.0 carries the same), so the line is one release everywhere it runs.