sync: re-pin the line onto kagent-dev/substrate v0.3.0-alpha3

[QuentinBisson]

Problem

The line sits on kagent-dev/substrate v0.2.0-beta4 while kagent main@bf8afa56 replaces the module with v0.3.0-alpha3 and speaks its ate-api (GA egress rules, server-side default ports, ateletpath, LocalSnapshot, the ateom-for-actor SPIFFE identity).

Change

Candidate sync/20261005-v0.3.0-alpha3: upstream v0.3.0-alpha3 at the base, 84 carried commits replayed on top (the 2026-09-29 alpha1 probe rebased, then the 34 commits giantswarm gained since). Dropped e3671af8 (otlploggrpc, upstream has v0.21.0); the fork-only default egress policy is replaced by the agent-substrate#1558 cherry-picks with their tests re-seated on GA rules. Chart images.agentgateway and the CircleCI parameter move to the line's agentgateway 2.3.0 (upstream v1.6.0 + carried); the pin annotation names v0.3.0-alpha3; the 54 docs(fork) commits are folded into one ledger commit and FORK.md records the re-pin.

This pull request is for review and CI only: the candidate is force-pushed onto giantswarm after the agentlab proof with the kagent re-pin, and the pull request is closed, never merged. Release order: promote v1.4.0-rc.7 to 1.4.0 first, then the force-push cuts the next rc.