sync: re-pin giantswarm onto v0.5.0-alpha2

[heraldbot]

Re-pin of giantswarm from v0.4.0-alpha1 onto v0.5.0-alpha2, finished by hand on this branch (description written by an agent on the maintainer's behalf).

Problem

Upstream kagent's go.mod names Substrate v0.5.0-alpha2; the line is still on v0.4.0-alpha1, so the kagent line cannot re-pin onto upstream kagent main.

Proposed solution

git rebase --onto v0.5.0-alpha2 v0.4.0-alpha1 of the line at fe803596, the ledger-only commits folded into one ledger commit, then the line's newer commit 926eedfe cherry-picked. Dropped because upstream carries them: the cherry-picks of upstream agent-substrate#2110 and agent-substrate#2111, the atelet refusal of an empty trust-bundle projection (upstream 601c03ba), the identity e2e trust-bundle rotation, the serverboot half of the OTEL_TRACES_EXPORTER=none patch (upstream agent-substrate#2193). FORK.md and fork/ list every drop and adaptation.

Persisted formats this step changes, and their migration

Row	v1.8.x wrote	v0.5.0-alpha2 reads	Migration
Actor LocalSnapshot	field 2 node_vms_with_local_snapshots (list), field 3 content_scope	field 2 content_scope; the node in node_name (field 5, the line's)	on read: node from the old list, scope from field 3
Actor ActorStatus	node only on the worker assignment and the local snapshot	assigned_node (field 10) decides where the actor lives	on read: the worker's node, else the local snapshot's
ActorTemplate SnapshotConfig	on_pause (field 1)	gone; a pause captures on_commit (upstream agent-substrate#2309)	none needed: each local snapshot records its own scope
PostgreSQL schema	migrations 1–3 and the line's own	unchanged	none
gVisor snapshot layout	PerVolume	unchanged (upstream agent-substrate#2283 is micro-VM only)	none

The migration is the line's own (fix(ateapi): read a 1.8 actor's local-snapshot node and assigned node): upstream keeps no compatibility before v1.0.0. A migrated row is persisted by the actor's next update.

Wire changes between ateom, atelet and ate-api

• SetWorkerCapacity is RegisterWorker on WorkerService and AteomSupport, with a HardwareIdentity (upstream Worker: Report node HardwareIdentity during Worker registration agent-substrate/substrate#2282). During the roll an ateom of the old release retries its capacity report until its pool rolls; workers it registered keep their capacity, and the scheduler does not read the hardware identity.
• MintActorJWTRequest.actor_uid is gone (upstream MintActorJWT no longer takes the actor's UID agent-substrate/substrate#2207); the egress gateway's field is ignored.
• atelet ExternalVolumeSource.access_mode and read_only move to fields 10001 and 10002 (upstream took field 4 for publish_context); across the roll an old ate-api's mode reads as the default read-write-once.
• The control API answers through internal/apierror: every carried status.Errorf or status.Code on its errors is ported, or a carried Unavailable would reach the caller as Internal.
• The ateom proto is unchanged; EgressPolicy and EgressRule are unchanged, so the egress-policy contract stays v0.4.0-alpha1.

Chart

The line keeps its own PostgreSQL interface and the in-chart certificate controller (upstream moved both out), so an installation upgrades in place; upstream's per-component resources defaults (with memory limits) are taken. The data plane stays on the agentgateway line's 2.3.0.

Acceptance criteria

• go build ./..., go vet ./..., go test ./..., helm unittest charts/substrate (100/100) and the gofmt, boilerplate, go-modules, codegen, crd-chart and golangci-lint verifiers pass locally on 79469558
• run-tests, govulncheck and fork-ledger pass on this branch's head
• Actors created on a v1.8.x release resume, suspend and run a turn after an in-place upgrade to the release candidate of this line
• Landed with Actions → sync-upstream, land = sync/20261012-v0.5.0-alpha2, line = giantswarm; never merged

Line head: 926eedf

[heraldbot]

Landed: giantswarm is now 73da0a6de8b777afbdfadfc07417619cfd9714ba, the head the required checks passed on.

[heraldbot]

Landed: giantswarm is now 73da0a6de8b777afbdfadfc07417619cfd9714ba, the head the required checks passed on.