fix(connectivity): create only the chart's own grant key Secret

[teemow]

Problem

With workspaces.enabled, providers and oauth.enabled, the connectivity chart of 4.128.0-rc.1 (#940) creates the Secret workspace-manager.grant.signingKey names — the installation's own reference included — and refuses the render when a Secret of that name exists without a Helm owner, the key an installation placed itself (a lab does, ahead of its install): Secret agent-platform/<name> (workspace-manager.grant.signingKey) exists and is not this release's (no Helm release) … set workspaceManager.grantKey.create: false. Every platform that references a grant key Secret of its own breaks on the upgrade, and UPGRADE.md named no action.

Proposed solution

The chart creates only its own Secret, workspaceManager.grantKey.secretName with the entry .key, when the manager's reference is that one: the reference the meta chart derives, or an own reference naming exactly that Secret and entry (agent-platform.workspaceManager.grantKeyEnabled). A reference to another Secret is the installation's own key: nothing is created for it and the owner guard never touches it; the guard, which still protects a Secret of the chart's own name that another owner holds, names both ways out. workspaceManager.grantKey.create: false stays what it was: nothing created, nothing forwarded. The helper also takes an absent workspaceManager block.

The rule is the exact match rather than "a reference set at all": an installation that spells the chart's own name in its reference still means the chart's Secret and keeps getting it; everything else is the installation's. The values comments of both charts, the README, the CHANGELOG entry of #935 and a new UPGRADE.md section (operator action: none) say so.

tests/verify-workspace-grant-key.py now asserts: no Secret for the fixture's own reference, nor for a reference that differs from the chart's own in name or in entry; the chart's Secret (generated per render, kept on uninstall) for an own reference naming exactly it; the default, the none cases, the forward, NOTES and the guards as before.

Acceptance criteria

• Render tests: make verify-workspace-grant-key, verify-workspace-manager-route and verify-workspace-manager pass; verify-schema-symmetry, verify-mirrored-values, verify-labels, verify-components and verify-scenarios pass; the default renders of both charts are byte-identical to main.
• On a lab that places its own grant key Secret ahead of the install and references it, agentlab platform on this chart passes with no overlay, and the manager signs with the lab's key.

Proof

On a kind lab (agentlab v0.93.0, agent-platform 4.127.1, workspaces on with the fake and the github provider instances, agents on) that places its own key as the Secret agent-platform/workspace-manager-grant ahead of the install, with no Helm owner, and sets workspace-manager.grant.signingKey: {name: workspace-manager-grant, key: grant} — the shape on which 4.128.0-rc.1's render refused Secret agent-platform/workspace-manager-grant … exists and is not this release's (no Helm release):

• agentlab platform with this branch's charts (platform.chartPath, no overlay) rendered and installed: the connectivity release runs the checkout's chart (1.1.35+e11208c6d697, Ready), the workspace-manager release Ready.
• Nothing of the lab's key moved: the manager's Deployment still carries --grant-signing-key=workspace-manager-grant/grant, its pod is the one from before the install (no roll, no restart), the Secret workspace-manager-grant keeps its creation time, its one entry and no owner annotation, no workspace-manager-grant-keys Secret exists, and GET /.well-known/jwks.json on the manager's host answers 200 with the same single key (kid WN0qYvRv0N16t7HEomAJlmMniP1UscDbXsj7wuWQgSw) before and after.
• The lab step failed afterwards in the lab's own Kyverno add-on (helm upgrade --install kyverno …: CustomResourceDefinition "cleanuppolicies.kyverno.io" … exists and cannot be imported, the CRDs owned by a kyverno-crds release), after the chart install had completed: a lab condition unrelated to this change.
• The lab was put back on its released chart afterwards, its configuration byte-identical.

Closes #944

Written by an agent.

[circleci-architect]

Published Helm chart agent-platform

4.127.2-r4fc23274t20261011211323h2c41ce8

Chart	agent-platform
Version	4.127.2-r4fc23274t20261011211323h2c41ce8
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.127.2-r4fc23274t20261011211323h2c41ce8
Digest	sha256:4028210c032d7316c75191e9654a06bb5024e4e2826bef8ceaa25b8d906e5dd0
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.127.2-r4fc23274t20261011211323h2c41ce8

_{Posted by architect-orb · build 21449 · commit 2c41ce8 · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.127.2-r4fc23274t20261011211323h2c41ce8

Chart	agent-platform-connectivity
Version	4.127.2-r4fc23274t20261011211323h2c41ce8
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.127.2-r4fc23274t20261011211323h2c41ce8
Digest	sha256:9b17e80333fcbeeb54b147e96f99b6bd64fb075779b224e9560bec1ceafab0f8
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.127.2-r4fc23274t20261011211323h2c41ce8

_{Posted by architect-orb · build 21448 · commit 2c41ce8 · updated in place on every push}