feat(workspaces): forward the StorageClass to workspace-manager rc.13

[teemow]

Problem

The follow-up #906 announced: with workspaces on, workspaces.storage.storageClassName reached the connectivity release but not the workspace-manager release, because the floor (>=0.1.0-rc.10) has a closed schema that refuses storage. Two more mismatches with the workspace-manager chart (giantswarm/workspace-manager#19): the meta chart declared a workspace-manager.signInStore.encryptionKey the chart has never taken (its sign-in keys are signin.keys {secretName, current}, forwarded since #907), and the sync.cycle comment called it the mirror fetch interval, while it is the controller's reconcile period.

Proposed solution

• components.workspace-manager.versionRange is >=0.1.0-rc.13 <1.0.0: rc.13 (fix(chart): take every key the agent-platform meta chart forwards workspace-manager#21) is the first release whose schema declares every key the meta chart forwards. The BOM pins 0.1.0-rc.13.
• The meta chart derives workspace-manager.storage.storageClassName from workspaces.storage.storageClassName (componentDerivedValues, next to workspaces.namespace); an own value that disagrees fails the render naming the key.
• workspace-manager.signInStore is removed from values and omitEmptyKeys; a signInStore block fails the render naming signin.keys. Every other forwarded key (oauth, muster.mcpServer, signin.keys, providers, grant.signingKey, sync.cycle, sessions.cleanupAfter, storage.*, serviceMonitor, observability.otel, workspaces.namespace) is declared by rc.13 under that name.
• sync.cycle comment and README: the reconcile period (default 10m), not the fetch interval; each Workspace's spec.sync decides when mirrors are fetched.
• Tests and fixtures: verify-workspace-manager (the class forwarded, signInStore refused, 5 credentials), verify-workspace-storage (the forward and the disagreement guard); CHANGELOG.

The README edits overlap #895 (README rewrite) on a few lines of the Workspaces section, as #906 and #907 did; whichever merges second merges main.

Acceptance criteria

• make verify-workspace-manager verify-workspace-storage verify-workspace-manager-route pass.
• make verify-components-charts renders workspace-manager 0.1.0-rc.13 with the forwarded block (the class included) in every shape.
• In the agentlab, with workspaces on and storage.storageClassName set from the chart path, the workspace-manager HelmRelease is Ready on rc.13 with storage.storageClassName in its values.

The remainder of giantswarm/workspace-manager#18.

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.123.1-r7e3305f6t20261010035556hd35fd95

Chart	agent-platform-connectivity
Version	4.123.1-r7e3305f6t20261010035556hd35fd95
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.123.1-r7e3305f6t20261010035556hd35fd95
Digest	sha256:cff630f2a64a08aff2dc464485887f15d63260c62106f617561d590936d540a6
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.123.1-r7e3305f6t20261010035556hd35fd95

_{Posted by architect-orb · build 20916 · commit d35fd95 · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform

4.123.1-r7e3305f6t20261010035556hd35fd95

Chart	agent-platform
Version	4.123.1-r7e3305f6t20261010035556hd35fd95
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.123.1-r7e3305f6t20261010035556hd35fd95
Digest	sha256:48440f147753e814159adc846e8eeea473533f3b7236bfce23c4f9ccf7f68632
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.123.1-r7e3305f6t20261010035556hd35fd95

_{Posted by architect-orb · build 20915 · commit d35fd95 · updated in place on every push}

[teemow]

Lab proof (written by an agent): the PR's chart installed from the working tree on a local kind lab with workspaces on and workspaces.storage.storageClassName: agentlab-workspaces (an in-cluster NFS server behind the NFS CSI driver).

• HelmRelease workspace-manager: Ready, "Helm install succeeded … with chart workspace-manager@0.1.0-rc.13"; the OCIRepository resolved >=0.1.0-rc.13 <1.0.0 to 0.1.0-rc.13.
• Forwarded values: storage: {storageClassName: agentlab-workspaces}, signin.keys: {current: key-1, secretName: workspace-manager-signin-keys}, workspaces.namespace: kagent, no signInStore; rc.13's schema accepted them.
• The manager runs serve … --storage-class=agentlab-workspaces --sync-cycle=10m …, 1/1 ready; its MCPServer is Connected through muster and forwarded id_tokens are accepted.
• The lab's workspace storage proof (a read-write-many claim on the class, a shared clone per session sub-path, modes and links intact, isolation, read-only mounts) and the platform smoke test passed.