Runtime slice values example: kagent only, for workload clusters that run agents managed from the installation (a kubeConfig-targeted HelmRelease of this chart) #317

Problem

A CPU workload cluster runs agents managed from the installation and never becomes a second installation (giantswarm/giantswarm#37611, Phase 3). What has to be on that cluster is the agent runtime slice — the kagent controller and CRDs plus what the agent chart needs at run time — installed from the installation through a HelmRelease targeting the cluster's kubeconfig Secret (cluster-manager's enable_agent_platform). The chart needs a supported values shape for exactly that.

Successor of giantswarm/agent-platform-standalone#169 (the umbrella's version; the platform ships as this chart now).

Proposed solution

A documented, verified values example (helm/agent-platform/examples/runtime-slice.yaml) that installs only the runtime slice: kagent (controller, CRDs, the agent chart's OCIRepository access) and nothing else of the platform's control plane — no Backstage, no model-manager, no agent-manager, no MCP servers, no agentgateway/edge unless kagent needs it; global.identity pointing at the installation's identity provider; egress to the installation's muster and model endpoints. Two contract questions, settled by #328 (the slice toggles and the target knob) and #766:

• muster, dicebear and the connectivity wiring are always on in this chart (no enabled key); the slice needs them off or minimal — either the trio gains toggles or the slice's shape documents the minimum they render. If a component cannot be turned off cleanly, fix the contract.
• the engine: a workload cluster without Flux gets one from the chart (components.flux.enabled: true — the agents' own HelmReleases need a helm-controller on that cluster anyway) while the installation's Flux reconciles the kubeConfig-targeted HelmRelease of the chart; or the installation's Flux reconciles everything remotely. Decide, document, and make the render guard's behaviour on that path explicit.

A make verify check renders the example and asserts the component set.

Acceptance criteria

• helm template -f examples/runtime-slice.yaml renders kagent and nothing else of the platform's control plane: kagent-crds, substrate-crds, substrate, kagent, agentgateway and connectivity (feat: examples/runtime-slice.yaml, the runtime slice for workload clusters #766, make verify-runtime-slice).
• Installed on a workload cluster through a HelmRelease with spec.kubeConfig.secretRef from the installation, an agent placed there by agent-manager (Target cluster: place and manage agents on a workload cluster from the installation (HelmRelease kubeConfig.secretRef, status through the cluster's kubeconfig, as the caller) agent-manager#22, v1.9.0) becomes Ready.
• README section "The runtime slice on workload clusters" with the identity and egress preconditions and the engine decision (feat: examples/runtime-slice.yaml, the runtime slice for workload clusters #766). The engine decision: the installation's Flux reconciles every component remotely through gitops.target.kubeConfig, and the workload cluster runs no Flux.

Epic: giantswarm/giantswarm#37611 (KaaS in the Agent Platform), Phase 3. Plan: bumblebee-plans#42. Related: giantswarm/agent-manager#22, giantswarm/giantswarm#37618.

Under meta chart 4.0 (kagent API v2, bumblebee-plans#51 D3, epic giantswarm/giantswarm#37705) the runtime slice includes Agent Substrate and the platform Harness beside the kagent controller and CRDs: see #342 (Substrate inside the chart) and #344 (the platform Harness).