v0.4.2

Superseded: Use v0.4.3. v0.4.2 can render the runner gateway NATS endpoint empty when using the documented defaults.

Platform Orchestrator Helm chart 0.4.2

This patch makes the NATS JetStream bootstrap Job compatible with the bundled
NATS CLI and with the chart's intentionally non-system application token. It
also carries forward the complete configurable Casbin RBAC release from chart
0.4.1.

Included versions

Component	Version
Control plane	v2.0.0
Data plane	v3.0.0
IAM	v2.1.0
Runner	v3.0.0
Console	v1.1.0
Kubernetes runner chart	0.3.0
NATS Helm dependency	2.14.0

What changed

• The bootstrap readiness check now uses an authenticated NATS protocol RTT.
• The check no longer uses the removed server ping --count=1 CLI syntax.
• The bootstrap no longer requires access to the NATS $SYS account.
• CI renders the bootstrap contract and validates the command against the exact
  NATS CLI image selected by the chart.

Upgrade

Upgrade from 0.4.1 normally; no application or database migration is needed.
Installations upgrading from a supported SpiceDB-based release still receive
the automatic, fail-closed Casbin migration described in the
SpiceDB-to-Casbin upgrade procedure.

Qualification

• The corrected readiness command completed against a deployed, token-protected
  NATS instance without system-account permissions.
• The chart passed Helm linting, chart-testing, release-contract tests, and a
  full render before publication.