Re-pin the fork line onto upstream v0.5.0-alpha2 and release it #343

Written by an agent on behalf of the fork's maintainers.

Problem

The fork line's releases up to v1.8.x are based on upstream v0.4.0-alpha1. The kagent fork (giantswarm/kagent-upstream) cannot re-pin onto upstream kagent main@92dd6ca: that commit moves kagent to Substrate v0.5.0-alpha2 and imports github.com/agent-substrate/substrate/pkg/postgressetup, which exists only from v0.5.0-alpha2 on.

Waiting on this:

• giantswarm/kagent-upstream#416, the kagent re-pin onto main@92dd6ca.
• giantswarm/kagent-upstream#297, egress caller credentials per Session on upstream's actor-JWT token exchange, which follows the re-pin.

Root cause of the migration scope

agent-substrate#1809 (the ateom/actor identity split) is already in the v1.8.x line since its v0.3.0-alpha3 pin. The diff v1.8.x..v0.5.0-alpha2 changes:

• Actor LocalSnapshot: the node list is gone and content_scope moves fields; ActorStatus.assigned_node (new) decides where an actor lives. Migrated on read.
• The actor containers' RLIMIT_NOFILE (1024 → 1048576): runsc refuses a restore whose Rlimits differ from the checkpoint's, so every golden and paused actor checkpointed on v1.8.x would crash on its first restore. The line keeps 1024 (#353); the general fix is agent-substrate/substrate#2530.
• The certificate controller requires a PostgreSQL CA pool the line's chart does not have; on the line it runs that signer only with a pool.
• The PostgreSQL schema and the snapshot file layout are unchanged.

Proposed solution

1. Re-pin giantswarm onto v0.5.0-alpha2 (#346, landed), each carried change one commit with its ledger file.
2. The migrations above, on the line.
3. Prove the step on Actors created on v1.8.x, then promote; the kagent line bumps its Substrate pin.

Status: v1.9.0 (promoted from v1.9.0-rc.3, merge base v0.5.0-alpha2) passed the step proof from v1.8.4: a suspended conversation resumes with its turns and durable volume during a worker drain, and a new conversation starts from the golden kept across the step. Stepping back to v1.8.x stalls on #352.

Acceptance criteria

• A release of the line whose merge base with upstream is v0.5.0-alpha2 (v1.9.0).
• Actors from a v1.8.x release resume on it through the automatic migration, with no manual step.
• Upstream kagent main@92dd6ca builds against it (pkg/postgressetup resolves).
• The release promoted.