fix(observability): give Substrate's OTLP export a tenant and a way out

[QuentinBisson]

Problem

On gazelle, ate-api-server, ate-controller, atelet and atenet-router export to otlp-gateway.kube-system.svc:4317, and Tempo has no span from them (giantswarm/giantswarm#36711). No Substrate pod carries observability.giantswarm.io/tenant, and the chart has no headers key, so otlp-gateway drops every signal as tenant-less. Also, only the ate-api-server policy allows 4317, so the other three exports never reach the collector.

Change

• substrate.podLabels: {observability.giantswarm.io/tenant: giantswarm} in the meta chart. The substrate chart takes the key from 1.1.0 (feat(chart): podLabels on the chart's pods substrate#55, which carries feat(helm): add podLabels for the chart's pods kagent-dev/substrate#48). 1.0.x ignores it, so the label arrives with the re-pin's range move, not with this PR.
• agent-platform.substrate.otlpEgress opens the namespace and port of each enabled signal's endpoint on the four exporters' Cilium policies. It replaces ate-api-server's fixed cluster:4317 rule, with a golden hold in verify-target.py.
• Sampling stays at parentbased_traceidratio 0.01. Spans under a kagent turn follow the turn's decision, so the ratio applies only to parentless background work.
• make verify-substrate-otlp.

Checklist

• Update changelog in CHANGELOG.md.
• Make sure values.yaml and values.schema.json are valid.

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.66.8-r72dfe194t20260924110036h00c0f9e

Chart	agent-platform-connectivity
Version	4.66.8-r72dfe194t20260924110036h00c0f9e
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.66.8-r72dfe194t20260924110036h00c0f9e
Digest	sha256:4b6f79e6a4cf93424babef5120022e6ca795a63099c015e8dbb4370ebbea1a0b
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.66.8-r72dfe194t20260924110036h00c0f9e

_{Posted by architect-orb · build 12661 · commit 00c0f9e · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform

4.66.8-r72dfe194t20260924110036h00c0f9e

Chart	agent-platform
Version	4.66.8-r72dfe194t20260924110036h00c0f9e
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.66.8-r72dfe194t20260924110036h00c0f9e
Digest	sha256:2057afca72e37404efc109b8f0dc40963e0ff91abd868a87b851bcbbd9aeb65d
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.66.8-r72dfe194t20260924110036h00c0f9e

_{Posted by architect-orb · build 12662 · commit 00c0f9e · updated in place on every push}