agent-platform release v4.7.10

Changed

• The Substrate pin moves to 0.0.27-gs.5 (components.substrate and components.substrate-crds floor, the customer BOM, kagent.substrateWorkerPool.workerImage): gs.3 plus a golden boot whose image the registry refuses failing instead of resuming forever (gs.4, giantswarm/substrate#14 — giantswarm/giantswarm#37742 row 27) and the podcertificate-controller-system namespace kept across an uninstall (gs.5, giantswarm/substrate#13 — #384).

Fixed

• A reinstall after helm uninstall brings Agent Substrate up with a consistent trust chain (giantswarm/agent-platform#384). The uninstall took the podcertificate-controller-system namespace and the two CA pools in it with the substrate release while the signers’ cluster-scoped ClusterTrustBundles stayed; the reinstall minted new roots and the podcertificate-controller republished the bundles within seconds, but every Substrate pod had projected the surviving bundle when it started and reads its CA once, at dial time — x509: certificate signed by unknown authority against ate-api-server from ate-controller, atelet and the atenet router, no golden boot (the own-Flux ATS scenario on the cluster the smoke had uninstalled from, PR #380). Two halves: the Substrate line keeps the namespace across an uninstall (helm.sh/resource-policy: keep, 0.0.27-gs.5, giantswarm/substrate#13 — the pin below), and the connectivity bootstrap hook publishes both signers’ ClusterTrustBundles from the pools (server-side, the way it applies actor-id-ca-certs) before the substrate release installs and on every upgrade, so a bundle never reaches a pod with roots its pool does not have; the hook’s ClusterRole gains clustertrustbundles (get, list, watch, create, patch) and attest on the two podcert signers (the apiserver admits a bundle that names a signer only from a client allowed to attest it). The ATS smoke no longer removes Substrate’s leftovers between its scenarios: the own-Flux scenario reinstalls onto the cluster the smoke uninstalled from — the kept namespace, pools and bundles in place — and asserts each signer’s bundle carries its pool’s roots; the smoke asserts what the uninstall leaves.