agent-platform release v4.66.8

Substrate’s OTLP export reaches the collector with a tenant: substrate.podLabels and the connectivity chart’s Substrate egress follow substrate.otel (giantswarm/giantswarm#36711). The meta chart sets substrate.podLabels to observability.giantswarm.io/tenant: giantswarm, the label otlp-gateway routes a headerless export by; the substrate chart takes the key from the line’s 1.1.0 (giantswarm/substrate#55, carrying kagent-dev/substrate#48), an older release ignores it. The substrate-ate-api-server, -ate-controller, -atelet and -atenet-router Cilium policies open the namespace and port of each enabled signal’s endpoint (agent-platform.substrate.otlpEgress); ate-api-server’s fixed rule to the cluster entity on 4317 is gone, and no endpoint opens nothing. Trace sampling stays at the chart’s parentbased_traceidratio 0.01. make verify-substrate-otlp asserts it. Every installation with Substrate on gets the four changed policies; the Substrate pods roll once on the upgrade to 1.1.0 (the pod label).