feat(meta): muster.muster.toolsetPresets — infrastructure and agent-platform toolset presets selecting by the tool-group label; components.muster.versionRange floors at 5.12.0

[teemow]

Closes #273 — rollout step 2 of the tool-access plan (PRD, epic giantswarm/giantswarm#37435).

What

• muster.muster.toolsetPresets — the platform's two toolset presets, forwarded into muster's config:
  • infrastructure: label: agent-platform.giantswarm.io/tool-group=infrastructure (the mcp-kubernetes / mcp-capi / mcp-prometheus families; label stamped by agent-platform-mcps ≥ 0.9.0).
  • agent-platform: label: agent-platform.giantswarm.io/tool-group=agent-platform + pattern: core_* (agent-manager ≥ 0.3.0, model-manager ≥ 0.18.0, muster's core tools — the meta agent's preset).
  • Both with the descriptions from Ship the infrastructure and agent-platform toolset presets as muster.toolsetPresets values selecting by the tool-group label #273. Resolved live per request, so a new manager or infrastructure family joins its preset with no values change. Installations add their own next to them (Helm merges the map).
• components.muster.versionRange: 5.x → >=5.12.0 <6.0.0. The label: rule exists from muster 5.12.0 (muster#1171); a 5.11.0 muster refuses to start on it. With the floor the OCIRepository resolves a chart that has the rule before the HelmRelease applies the values that need it. Minor releases keep rolling forward on their own.
• Render guard: a toolsetPresets entry named read-only, none or full fails the meta render naming it (muster would refuse to start on it, out of sight in Flux).
• examples/customer-bom.yaml refreshed to the dogfooding track's resolved versions (muster 5.12.0, agent-platform-mcps 0.9.0, agent-manager 0.4.0, model-manager 0.18.0, agentgateway 2.0.7, kagent 0.1.48, klaus-gateway 0.39.0, agent-sandbox 0.2.31, dicebear 0.3.10, valkey 0.1.4, connectivity 3.10.0); the old pins (muster 0.9.0, …) predated the chart's current line and would not start with these values.
• make verify-presets (new, in the test-ingress-modes CI job): asserts both presets on the muster HelmRelease (flux) and Application (argo) with the label rules and the range floor; pulls the muster chart at the floor version anonymously from gsoci and renders its ConfigMap from exactly the values the meta chart forwards (so the real 5.12.0 schema and template validate them); asserts the built-in-name guard. tests/verify-toolset-presets.py is stdlib-only like its siblings.
• Docs: docs/toolset-presets.md (the presets, requirements, how an installation adds test-clusters-style presets by server: / by its own label / by composition, verification recipe), README subsection, UPGRADE.md section, CHANGELOG.

Values path

#273's snippet shows muster.toolsetPresets; in this chart that key is muster.muster.toolsetPresets — the outer muster: is the component block forwarded verbatim to the muster release, and the muster chart's own values put toolsetPresets under its muster: key (.Values.muster.toolsetPresets in its templates/configmap.yaml). The muster chart's root schema is additionalProperties: false, so a top-level toolsetPresets would have been rejected by the release. Issue body corrected accordingly.

Verified

$ make verify-modes verify-global verify-meta verify-managers verify-kagent-netpol verify-postgres verify-secrets verify-presets   # all ok
$ make verify-presets
--> the muster HelmRelease values carry both presets, selecting by the tool-group label   ok
--> components.muster.versionRange floors at the muster that has the label rule            ok
--> the argo engine forwards the same presets                                              ok
--> muster 5.12.0 accepts the forwarded values and renders the presets into its ConfigMap  ok
--> a preset that redefines a built-in is refused by the meta chart before it reaches muster ok

Rendered muster 5.12.0 ConfigMap (config.yaml), from the forwarded values:

    toolsetPresets:
      agent-platform:
        description: The platform's own management surface — agent-manager, model-manager, cluster-manager and muster's core tools.
        include:
        - label: agent-platform.giantswarm.io/tool-group=agent-platform
        - pattern: core_*
      infrastructure:
        description: The servers for the infrastructure underneath the platform (Giant Swarm installations' management clusters) — mcp-kubernetes, mcp-capi, mcp-prometheus.
        include:
        - label: agent-platform.giantswarm.io/tool-group=infrastructure

pre-commit run --all-files clean (schema unchanged — the muster block is skipProperties; helm-docs README regenerated).

Not lab-verified: this is a chart-only values change (the render assertions above, against the real muster chart, are the test); the standalone chart proves the same values through kagent in agentlab when its curate pin moves to 5.12.0 (agent-platform-standalone#172). Live proof follows on the internal installations after the release: both already run muster 5.12.0, agent-platform-mcps 0.9.0 (and one agent-manager 0.4.0), and today filter_tools({toolset:["preset:infrastructure"]}) there answers unknown preset "infrastructure"; known presets: read-only, none, full — the presets this PR ships.

Rollout

Fleet installations track >=2.5.5; the muster release rolls its pod once (config change). Teammate PRs #272 / #254 untouched; edits here are additive in the muster values block, components.muster, the BOM assertion and a new make target.