agent-platform release v1.1.24

Update agentic-platform-mcps to v0.3.0: new agentgateway.jwt.extraProviders value lets the inbound agentgateway JWT policy accept tokens from additional issuers (e.g. Dex-issued ID tokens forwarded by Backstage AI chat alongside muster-issued JWTs, giantswarm#36840). Also fixes the identityProviders values schema that rejected every populated provider map.

templates/kagent/declarative-agent-pod-security.yaml: retarget the Kyverno mutate from Deployment (controller output) to Agent CR (controller input). The previous policy patched the Deployment after the kagent controller had already stamped privileged: true on the git-skills path, causing the API server to reject the Deployment as self-contradictory (privileged: true + allowPrivilegeEscalation: false). Mutating the Agent CR instead sets allowPrivilegeEscalation: false on the controller input, which trips the controller’s own guard and prevents privileged: true from being set in the first place. A (type): "Declarative" condition anchor scopes the mutation to Declarative agents only.