agent-platform release v4.9.0

The chart provisions Agent Substrate’s snapshot store on CAPA (giantswarm/agent-platform#411, giantswarm/giantswarm#37705 wave 1e): kagent.harness.snapshotStore.crossplane renders the S3 Bucket (lifecycle expiration aws.lifecycleDays, 30 days by default; public-access block; TLS-only policy; never deleted by Crossplane, kept by Helm) and the IAM Role trusted by Substrate’s atelet and ate-api-server ServiceAccounts in ate-system through the installation’s IRSA OIDC provider, the way postgres.backup.crossplane renders the kagent-pg backup bucket (the Crossplane helpers and the bucket/trust/policy partials are shared: agent-platform.crossplane.*). The meta chart derives kagent.harness.snapshotLocation = s3://<aws.bucketName>/<prefix> for the kagent release (an explicit value that differs fails the render naming both keys), holds the block back from the kagent chart (components.kagent.omitKeys takes dotted paths), and forwards the role’s ARN as eks.amazonaws.com/role-arn on the substrate release’s atelet.serviceAccount.annotations and ateApiServer.serviceAccount.annotations (Substrate 0.0.27-gs.8; a differing explicit role fails the render, an installation’s other annotations stay). Off by default; make verify-substrate-store, ci/test-substrate-store-aws-values.yaml; UPGRADE.md.