refactor(agents)!: remove agent creation, agents move to the generic agent chart

[fiunchinho]

What this PR does

Removes agent creation from the agentic-platform charts. Agents are now created by installing one release of the generic agent chart per agent, per the creating-agents PRD. The leftover agents values key is then dissolved entirely — it only held admin-owned kagent CRs, which was misleading.

Removed

• The whole agents.* values key from both the umbrella and connectivity values.yaml (including the eval-tuned sre-agent definition and its reciprocal keep-in-sync notes).
• The connectivity templates agents.definitions drove:
  • templates/kagent/agents/agents.yaml — the kagent Agent CR + chart-owned ServiceAccount.
  • the per-agent muster-<name> RemoteMCPServer loop in remotemcpservers.yaml — the agent chart references the shared muster server cross-namespace instead.
  • templates/kagent/agents/agentgateway-backends.yaml — the per-agent A2A AgentgatewayBackend + /agents/<name> HTTPRoute. Not part of the PRD's chart scope and unused: in-cluster A2A callers go through the kagent controller route (/kagent). extraObjects covers one-offs.
  • templates/kagent/agents/_agents.tpl — both helpers became unused.

Moved / renamed

• agents.models → kagent.modelConfigs (renamed to match the CR kind) and agents.remoteMcpServers → kagent.remoteMcpServers: both are admin-owned kagent CRs, so they now live in the kagent block next to providers (whose anthropic entry already yields the subchart-created default-model-config), under the same "read by connectivity templates, not the subchart" convention as controllerRoute/uiRoute.
• The rendering templates moved up from templates/kagent/agents/ to templates/kagent/.
• kagent.remoteMcpServers gains the schema validation it never had (required name/url, optional description/tokenSecret, additionalProperties: false).
• Leftover agents.* keys in per-cluster values are silently ignored on purpose (the root schema stays permissive for forwardAllValues): on the auto-updating dev track the chart version and per-cluster values can't change atomically, so the zero-gap migration is a dual-key overlap — a fail guard would turn that overlap into a red HelmRelease.

Kept (the admin-owned surface the agent chart depends on)

• The shared muster RemoteMCPServer (allowedNamespaces: {from: All}) — the platform contract the agent chart's default serverRef targets.
• The kagent-namespace policies (muster-egress CNP, Kyverno PolicyException, declarative-agent pod security, srt settings) — they apply to agent pods regardless of which chart created them.

⚠️ Migration (3 clusters, single tenant)

• Any cluster with agents.definitions.sre-agent.enabled: true in giantswarm-config must have an agent-chart-based replacement (carrying the eval-tuned systemMessage + muster toolNames) deployed before this upgrade rolls out, or the live Agent CR, its SA, and muster-sre-agent are deleted. This matches the PRD's PoC path (recreate sre-agent with the chart on glean).
• Per-cluster values setting agents.models/agents.remoteMcpServers: add the equivalent kagent.modelConfigs/kagent.remoteMcpServers keys before the chart rolls out (old chart reads the old keys, new chart reads the new ones — zero gap), then delete the old keys afterwards.

Trade-off noted

kagent.modelConfigs/kagent.remoteMcpServers ride into the kagent component's HelmRelease values (ignored by that chart today, like the routing keys). If upstream kagent ever introduces same-named values, they must be renamed here.

Follow-up (separate issue)

kagent.modelConfigs renders ModelConfigs only into the single kagent namespace, and the referenced Secrets are not rendered at all. The PRD's tenant-namespace model needs per-namespace ModelConfig + Secret provisioning once real tenant namespaces exist.

Verification

• helm template of the connectivity chart against all ci/*.yaml values files renders clean; with kagent.enabled + muster.enabled the shared muster RemoteMCPServer still renders and no Agent/per-agent CRs do.
• kagent.modelConfigs[0] + kagent.remoteMcpServers[0] set via --set render the expected ModelConfig and RemoteMCPServer CRs.
• Stale agents.models[0] set via --set renders clean and is ignored (the dual-key migration path).
• helm template of the umbrella chart with ci-values.yaml (flux + argo engines) renders clean; helm lint passes on both charts (also validates values against values.schema.json).

[fiunchinho]

The sre-agent migration this PR requires is prepared in giantswarm/giantswarm-management-clusters#2217 (agent-chart HelmRelease + OCIRepository for glean/gazelle/graveler; agent chart v0.2.2 is published and the OCIRepository floor resolves to it). Merge ordering: this PR's release must roll out first — the old Agent CR is Helm-owned by the connectivity release, so until it is pruned the new sre-agent HelmRelease fails install with an ownership conflict. (The shared muster RemoteMCPServer is already live via v1.22.1.)