agent-platform release v4.87.0

Every image the platform’s defaults name is on gsoci: substrate.images.awsCli is gsoci.azurecr.io/giantswarm/aws-cli:2.17.0 (same digest) and components.substrate{,-crds}.versionRange is >=1.1.2 <1.2.0 (giantswarm/agent-platform#580). The Substrate line’s 1.1.2 runs its rustfs-bucket-init Job as a Helm hook, recreated on every install and upgrade (giantswarm/substrate#85), so the Job’s image can change without the upgrade failing on its immutable pod template. make verify-images carries no pending entry any more, and make verify-substrate-images tolerates no key. The upgrade deletes the old Job, and the hook Job runs from gsoci and is removed once it succeeds. The kagent WorkerPool’s worker image follows the floor to ateom-gvisor:1.1.2.