agent-platform release v4.9.3

The atenet router reaches the worker pods on 8443 (giantswarm/agent-platform#383): substrate-atenet-router allowed the router’s egress to the worker pods on 443 only, but the router tunnels a turn’s A2A request to the actor through the worker’s mTLS CONNECT listener on 8443 (ateom --atunnel-connect-listen-address :8443), so under Cilium’s default-deny every turn on a fleet installation failed with upstream call failed: Connect: deadline has elapsed — graveler’s cut-over (giantswarm/giantswarm#37745) needed a hand-applied bridge policy. The policy now allows 443 and 8443; make verify-kagent-netpol asserts both. Installations act: none — the release rolls through the connectivity range; graveler’s bridge policy substrate-atenet-router-connect-cutover-bridge is removed once it is live there.