agent-platform release v4.65.4

Every OCIRepository the chart renders selects the Helm chart layer: layerSelector: {mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip, operation: copy} (giantswarm/agent-platform#649). Without a selector, source-controller extracts the artifact’s first layer. A signed chart carries its provenance as a second layer, and helm push orders the two by digest, so on about every other signed release the provenance comes first. The upstream CloudNativePG chart 0.29.1 is such a release: with components.cloudnative-pg on, the OCIRepository failed with requires gzip-compressed body: gzip: invalid header, stayed on 0.29.0 and read Ready=False. The artifact revision (<tag>@<manifest digest>) is unchanged, and helm-controller derives the chart version from it, so the rollout upgrades no release. make verify-components-charts now requires the selector on every rendered OCIRepository and resolves the selected layer in each resolved artifact, at the range and at the BOM pin. helm pull finds the chart by media type wherever it sits, so the check could not see this failure before. No range or source changes.