Substrate bump to da35a983 (2026-10-13): HttpGetAction rename

[Tomer Glottmann (tomergee)]

Moves the Substrate pin from f03327bd (2026-10-12, #77) to today's main, da35a983. 13 upstream commits.

What env needed

• substrate#2520 renames initialisms in the API proto: HTTPGetAction → HttpGetAction. Three call sites follow: cmd/ate-env/manifest.go and the two tests that build a WakeupProbe.
• Nothing else. The ateapi.proto diff in the range is that rename (also HTTPRule/HTTPSRule/TLSPassthroughRule, which env does not use) plus comment edits. JSON field names are unchanged, so the manifests on the wire are the same.
• Not relevant to env: atelet declarative validation (#1997), the objectstore-plugin rename (#2540; env does not reference the sidecar), health probes moving to :9091 (#2424), atenet→atunnel CONNECT (#2531).

README

The compatibility line names the new pin. It now says what the cluster has to accept (spec.sandboxClasses, snapshotConfig, wakeupProbe) instead of "at least that revision": the live cluster runs an older Substrate than da35a983 and takes these manifests, so the exact-revision wording was stricter than the truth.

Verification

• go build, go vet, go test ./...: 12 packages ok. make verify-gofmt verify-boilerplate pass. staticcheck reports only the three pre-existing ST1005 strings that Housekeeping: dependency bumps, lint debt, finished TODOs, dependabot #83 fixes.
• Manifest parity: ate-env manifest template --guest-image … --snapshots-bucket … built from this branch is byte-identical to the render from main at f03327bd (the one checked against the cluster in Bump Substrate to f03327bd: follow the current API and stop sending ate-target-actor twice #77).
• Not re-run on the cluster: the wire format did not change, so the Bump Substrate to f03327bd: follow the current API and stop sending ate-target-actor twice #77 live run still covers it.

Overlap

go.sum also moves in #83 (grpc/k8s/mcp bumps). Whichever lands second gets a go mod tidy rebase from me.

[Sunny (sunnylovestiramisu)]

dependabot auto bump in the future?

[Tomer Glottmann (tomergee)]

Not for this module. #83 adds Dependabot for the Go module, the Python client and the workflow actions, and excludes github.com/agent-substrate/substrate on purpose: each bump of it changes the generated API that the manifests use. This PR is the example: a plain version bump does not compile until HTTPGetAction becomes HttpGetAction, and the rendered manifests must be compared before and after. That stays a hand-made PR: bump, fix the compile breaks, diff ate-env manifest template output against the previous pin, update the README compatibility line. Everything else in go.mod gets the weekly grouped Dependabot PR.

[Sunny (sunnylovestiramisu)]

/lgtm

[Tomer Glottmann (tomergee)]

Thanks! One more click, please: this repo has no Prow, so /lgtm does not count. The ruleset on main needs one review submitted as Approve (Files changed → Review changes → Approve), and I cannot approve my own PR. Same for #83 and #82 if you have a minute; all three are green and merge clean.