v0.3.5

Summary

Platform release consumed by the Platform Engineering on EKS workshop (v0.3.5). This is a pre-OAP release — no agentic platform is wired. Highlights since v0.3.4:

Teardown — zero residue

• Sweep reaches zero residue: spoke-VPC re-drive, log-group filtering, build-failing completeness gate (#933), rebuilt on a tenacity resilience core with hermetic tests (#936).
• VPC selection by ownership tag + CRD-readiness gating for install/destroy (#922, #924).

Resilience — Identity Center & KubeVela

• IDC ↔ Keycloak federation tolerant to transient network errors; configure_identity_center refactored into a tenacity-based package (#917, #935).
• Hardened KubeVela admission-webhook bootstrap against the vela-core chicken-and-egg (#918).

Multi-account KRO

• global.accountId fallback (no hard-coded account IDs), automatic spoke OIDC provisioning, isolated cluster-provisioning RGDs (#927, #922, #942).

Other

• Spoke ALB scheme decoupled from insecure so spokes stay internet-facing (#947).
• Configurable platform-wide AWS tags for SpringClean retention via PLATFORM_TAGS_B64 (#934).
• Backstage multi-arch (arm64) build + kro-clusters seed (#923, #925); peeks/-prefixed depends-on annotations (#944).

---

What's Changed

• fix(idc): make IDC↔Keycloak federation resilient to transient network errors by @allamand in #917
• fix(kubevela): harden admission-webhook bootstrap against the vela-core chicken-egg by @allamand in #918
• fix(kro-clusters): stop requiring a real AWS account ID in git by @shapirov103 in #927
• Install/destroy resilience + automatic spoke OIDC by @shapirov103 in #922
• fix(backstage): multi-arch build (TARGETARCH kubectl, pinned CNOE ref, arm64 toolchain) by @allamand in #923
• fix(backstage): seed kro-clusters values.yaml for control-plane tenant (eks-cluster-template ENOENT) by @allamand in #925
• docs(kargo): fix stale v1.11.0 version comment in java project.yaml (native /kargo basePath already in main) by @allamand in #930
• fix(teardown): sweep reaches zero-residue (spoke VPC re-drive, log-group filter, completeness gate) by @allamand in #933
• feat(tags): configurable platform-wide AWS tags for SpringClean retention (#773) by @allamand in #934
• feat(peeks): emit agenticRepo block in create-config.sh (single config.local.yaml superset) by @allamand in #938
• Hotfix: KRO 9.4 capabilities upgrade - remove broken kro annotations by @zjaco13 in #942
• Update CODEOWNERS by @zjaco13 in #943
• (fix): re-add depends-on annotations under peeks/ prefix by @zjaco13 in #944
• refactor(sweep): tenacity-based resilience core + hermetic tests (#924, stacked on #933) by @allamand in #936
• refactor(idc): split configure_identity_center into a package with tenacity resilience (#924) by @allamand in #935
• fix(ingress): decouple ALB scheme from insecure (spokes stay internet-facing) by @allamand in #947

Full Changelog: v0.3.4...v0.3.5