fix(substrate): re-pin the line to v0.0.27-gs.4 — a golden boot whose image the registry refuses fails with the reason

[teemow]

Re-pins the Substrate line to v0.0.27-gs.4 (giantswarm/giantswarm#37757; giantswarm/giantswarm#37742 row 27; epic giantswarm/giantswarm#37705).

Why

A Harness whose workload.image cannot be pulled — a digest the registry answers 404 for, a repository the pull may not read — never booted and was never reported on gs.2: ate-api retried the failed ResumeActor with backoff, GoldenSnapshotStatus.ErrorMessage stayed empty, kagent reported Ready=False ActorTemplatePending for as long as anyone waited, and a worker stayed pinned to the golden actor (measured in giantswarm/agent's ATS: 300 s, no message — giantswarm/agent#26).

v0.0.27-gs.4 (tag on bbe92143) = gs.3 + giantswarm/substrate#14: the image cache tags a registry's final word (a 4xx other than 408/429) with ReasonFailedGetExternalObject, atelet's Run/Restore boundaries claim it, ate-api crashes the actor with the registry's answer and releases the worker, and the ActorTemplate reconciler records the cause on the template. kagent turns it into Ready=False ActorTemplateFailed — GoldenActorCrashed: actor ate-golden/<uid> crashed: … MANIFEST_UNKNOWN: manifest unknown — in seconds.

What moves

components.substrate / components.substrate-crds → >=0.0.27-gs.4 <0.0.28-0; kagent.substrateWorkerPool.workerImage → ghcr.io/giantswarm/substrate/ateom-gvisor:0.0.27-gs.4; examples/customer-bom.yaml and tests/verify-components.py (SUBSTRATE_RANGE, SUBSTRATE_PIN) move with the pin; the README/UPGRADE range mentions and the chart README follow. make verify-components green locally.

Overlaps #390 (the gs.3 re-pin for the CRD keep policy) on the same pin lines: gs.4 contains gs.3; whichever merges second rebases.

Verification

• The tag's publish run: every image and chart pushed, scans clean (the fork's FORK.md release row carries the digests).
• This PR's ATS smoke (execute-chart-tests) installs Substrate from the chart at the range's resolution, i.e. gs.4, and runs the agent path on it.
• giantswarm/agent's ATS asserts the fail-fast on gs.4 end to end (test_fail_fast.py::test_unpullable_harness_image_fails_fast, giantswarm/agent PR linked in #37742 row 27).
• Not lab-verified: the shared agentlab was not touched for this change (its Substrate is installed by agentlab at a compiled-in version); the CI runtime above is the proof venue where the defect was measured.

No installation acts — the release stays inert behind the fleet's <4.0.0 bound.

[teemow]

CI: execute-chart-tests fails in test_smoke.py::test_uninstall_is_the_ordered_teardown — the wait "Substrate's CRDs gone with the substrate-crds release (no keep policy on ate.dev)" times out, because v0.0.27-gs.4 contains gs.3's helm.sh/resource-policy: keep on the three ate.dev CRD templates, exactly the behaviour #390 asserts the other way round (its ATS changes in tests/ats/test_smoke.py, test_own_flux.py, conftest.py). This PR therefore lands after #390: once it merges, this branch is rebased onto main and shrinks to the gs.3 → gs.4 move plus the changelog; the Substrate half is already proven where the defect was measured (giantswarm/agent#34: execute-chart-tests green on gs.4, the unpullable-image case fails in 5 s with ActorTemplateFailed: GoldenActorCrashed: … MANIFEST_UNKNOWN). Everything else in this run passed (11 of 12).

[circleci-architect]

Published Helm chart agent-platform

4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a

Chart	agent-platform
Version	4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a
Digest	sha256:dc0ad485b254a7a7d4098391acfa785899ca12364ad573c5f7e38726ad905f8d
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a

_{Posted by architect-orb · build 6204 · commit 43ce12a · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a

Chart	agent-platform-connectivity
Version	4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a
Digest	sha256:01f785d75b9a52470889b746ccc0844b9683d8e75850eb76cac9248bc8d75bb1
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.7.9-dev.fix-substrate-re-pin-gs4.2026-09-11.14-29-42.h43ce12a

_{Posted by architect-orb · build 6207 · commit 43ce12a · updated in place on every push}