agent-platform release v4.144.0

The installation’s skills credential is never a tenant’s credential. agent-manager mints it as agent-manager-skills-token, the installation’s own name outside the tenant-credential- prefix; agent-platform-tenant-credential-refs refuses it in every Organization namespace under each of its names (agent-manager.skills.gitAuthSecretName or the minted Secret, and their earlier names, tenant-credential-agent-manager-skills-token included), as a git credentialRef or a headersFrom Secret, for every requester. The platform’s agents keep naming it in the kagent namespace. The connectivity chart’s agent-manager migrate run moves every agent naming tenant-credential-agent-manager-skills-token to agent-manager-skills-token, which agent-manager keeps filled; the earlier Secret stays filled until no agent names it. make verify-migration and make verify-tenant-rbac assert both.