agent-platform release v4.75.0

Changed

• One OTLP collector for the whole platform: global.observability.traces.otlp (endpoint, protocol, the new tenant, headers) sets every exporter’s destination (giantswarm/giantswarm#36711). The meta chart writes it into each component key that is now auto by default: kagent.otel.{tracing,logging}.exporter.otlp.endpoint and .tracing.exporter.otlp.protocol, OTEL_EXPORTER_OTLP_HEADERS in kagent.controller.env and kagent.harness.env, muster.muster.observability.otel.{endpoint,protocol,headers}, klausGateway.observability.{otlpEndpoint,otlpHeaders}, substrate.otel.endpoint, the tenant label in substrate.podLabels and gateway.parameters.podLabels, and the two OTLP entries of gateway.parameters.dataPlaneEnv (in both charts). A component key set to anything else wins. The defaults are the kube-system otlp-gateway on 4317 over gRPC with the giantswarm tenant, so every component renders as before. The tenant goes out as X-Scope-OrgID from kagent, muster and klaus-gateway, and as the observability.giantswarm.io/tenant pod label on Substrate and the data plane. kagent.otel.{tracing,logging}.exporter.otlp.insecure is auto too, false for an https:// endpoint. An empty endpoint exports nothing and turns kagent’s auto exporters and Substrate’s signals off; an X-Scope-OrgID in headers that differs from tenant fails the render, and so does protocol: http/protobuf while klaus-gateway, Substrate or kagent’s log exporter (gRPC only) would take the endpoint. The connectivity chart’s OTLP egress rules follow each exporter’s resolved endpoint. In the connectivity chart a dataPlaneEnv entry now wins over global.observability.traces.otlp (it used to lose), and make verify-otlp-global asserts the derivation and the egress rules.