agent-platform release v0.4.0

Restored restricted-PSS compliant securityContext/podSecurityContext defaults on the bundled valkey sub-chart, which were inadvertently dropped during the CRD-chart split (0.3.0). Without them, Kyverno’s disallow-privilege-escalation and restrict-seccomp-strict policies reject the muster-valkey Deployment because the init container reuses the main container’s securityContext and the upstream defaults omit allowPrivilegeEscalation: false and seccompProfile: RuntimeDefault.