agent-platform release v4.141.0

Added

• (tenants) Credential refs name only tenant credentials in #1068 by @teemow
• The Google access-token credential provider runs beside Substrate in #1046 by @QuentinBisson

Changed

• (deps) Update gsoci.azurecr.io/giantswarm/agent-manager docker tag to v2.3.1 in #1001 by @renovate[bot]
• (connectivity) Drop the portal’s dead rootRedirect and nav-item:agent-platform in #1070 by @marians

Fixed

• (tests) Retry a throttled registry with backoff honouring Retry-After in #1073 by @teemow

Full Changelog: https://github.com/giantswarm/agent-platform/compare/v4.140.0...v4.141.0

Release-candidate proof (v4.141.0-rc.5)

agentlab v0.110.2, a local kind test installation with tenants.organizations.enabled. agent-platform 4.140.0 upgraded in place to 4.141.0-rc.5. It moves no Substrate or kagent range (Substrate 1.12.0, kagent 1.13.0 before and after).

• All releases: 15 of 15 HelmReleases Ready on 4.141.0-rc.5.
• #1046: google-access-token-credential-provider 0.1.0 Ready in ate-system, after substrate; Deployment 1/1, Service :50051 and its CiliumNetworkPolicy in place. It loads its namespace policy and admits only spiffe://cluster.local/ns/ate-system/sa/atenet-egress. Nothing is routed to it in this release.
• #1001: the agent-manager migration Job ran on agent-manager:2.3.1; agent-manager is Ready.
• #1070: the portal’s app-config carries no rootRedirect and no nav-item:agent-platform; / answers 200 with the Agent Platform shell.
• #1068: proven on rc.1 (in #1068); agentlab tenants-test passes again here.
• #1073: test code only.
• agentlab platform-test: 13 PASS, 0 FAIL. agentlab tenants-test: 6 PASS, 0 FAIL.