agent-platform release v4.7.8

Fixed

• A kagent.modelConfigs[] entry’s provider is checked against the ModelConfig CRD’s enum at render time (giantswarm/agent-platform#357): agent-platform.modelConfigProvider fails the render for any other value, naming the entry and the ten providers — Anthropic, OpenAI, AzureOpenAI, Ollama, Gemini, GeminiVertexAI, AnthropicVertexAI, Bedrock, SAPAICore, Foundry, case-sensitive as the CRD’s. Until now provider: openai rendered and the API server refused the object at apply time with the enum error, after the chart had said nothing. The baseUrl already goes under the CRD’s block key through agent-platform.modelConfigBaseUrlKey (#333: anthropic, openAI, sapAICore, the three ModelConfigSpec gives one; the render refuses a baseUrl on the seven others), in templates/kagent/modelconfigs.yaml and the MutatingAdmissionPolicy alike; what was missing was the pin. ci/test-llm-routing-values.yaml carries an OpenAI entry with its own baseUrl, so make verify-kagent-crds validates the openAI key against the kagent line’s CRD on every run — and now sweeps every provider of the CRD’s spec.provider enum, read from the CRD at KAGENT_LINE_REF: each renders, a baseUrl lands under the block the CRD gives one to and nowhere else, the render refuses it where the CRD’s block has none, and a provider outside the enum (a lower-cased spelling included) fails naming the enum; a re-pin that moves the enum or a block’s fields fails the check naming the helper to move with it. make verify-llm-routing asserts the openAI key for an explicit URL and for the routed default with llmRouting.backend.provider: openai, and the enum guard. Lab-proven on agentlab (Kubernetes 1.37, the line’s controller): the fixture’s OpenAI ModelConfig applied as rendered, spec.openAI.baseUrl survived admission and the kagent controller reported Accepted and ResolvedRefs; the same object with the lower-cased openai block lost the field to pruning with a non-strict client and was Accepted all the same (a strict client refuses it as an unknown field) — the silent direct path the issue describes. No installation acts: every valid catalog renders byte-identically; only a render that the API server would have refused fails earlier.