lab installs the agent-platform meta chart in the lab shape (bundled engine on, self-management off); fluxUp, the vendored standalone chart and the post-renderer retire

[teemow]

Parent

Epic: giantswarm/roadmap#4348 — one coherent delivery story for the Agent Platform: one chart on every cluster; the standalone chart retires.
Plan: agent-platform-delivery in bumblebee-plans — PR #43 (merged 2026-09-08), PRD, decision Q7 (row 4). Slice 9 of 11.

What to build

agentlab tests what customers get. Today it vendors the standalone umbrella from git at a pinned SHA, side-installs two Flux controllers with its own fluxUp, patches the chart with a post-renderer and guards against the "old meta-package". With the one chart it installs giantswarm/agent-platform — the same chart as the fleet — in the lab shape: components.flux.enabled: true (the bundled engine brings source-controller and helm-controller), gitops.self.enabled: false (the lab installs unreleased charts, which a self HelmRelease would replace with the published one; the CLI keeps owning the release, so helm upgrade with dev images works as today).

• Retire fluxUp and the git-vendored standalone chart; the platform comes from the meta chart (a local chart directory or a branch publish for unreleased changes).
• The post-renderer's patches become per-component postRenderers values on the component HelmReleases the meta chart renders; dev-image swaps keep working through them.
• Image preload resolves the component charts from their OCIRepositorys instead of the umbrella's dependency archives.
• PlatformDown suspends the component HelmReleases before deleting the namespace, and Down relies on the chart's ordered teardown.
• Backstage, mcp-kubernetes and CNPG come from the new components (slice 5) and their wiring (slice 7); the lab's own Backstage deploy path stays retired.
• The release name stays agent-platform (the portal's installation key); drop the "old meta-package" guard.
• Existing lab users have no migration: the kind cluster is fresh on every up.

Acceptance criteria

• agentlab up on a clean machine installs the meta chart in the lab shape and reaches the same end state as today (muster, kagent, agentgateway, Backstage, mcp-kubernetes Ready; an agent deploys from the portal).
• No Flux controllers are installed by lab code; the chart's bundled engine is the only Flux on the cluster.
• A dev-image swap through the per-component postRenderers values works for muster, Backstage and kagent; helm upgrade of the lab release succeeds without extra flags.
• PlatformDown and Down leave no stuck finalizers; Down completes within the existing timeout.
• The lab's e2e proofs (auth, agent, portal session chat) pass unchanged.
• The vendored standalone chart, fluxUp, the post-renderer and the "old meta-package" guard are deleted; the README describes the lab shape and why self-management is off in the lab.

Blocked by

• giantswarm/agent-platform#283 — the engine subchart.
• giantswarm/agent-platform#281 — Backstage, mcp-kubernetes and CNPG as components.
• giantswarm/agent-platform#285 — their wiring in connectivity.

[teemow]

Done in #93 — merged as a326f10 (released as v0.23.0).

The lab installs giantswarm/agent-platform (pinned, platform.chartVersion: 3.20.0) in the lab shape — components.flux.enabled: true, gitops.self.enabled: false, gitops.namespace empty, the standalone's contract set explicitly — as one idempotent helm upgrade --install … --wait; the post-renderer's patches are components.<name>.postRenderers values, dev-image swaps ride the same values (platform.devImages), the image preload resolves the component charts from the rendered OCIRepositorys, mcp-prometheus is a lab-rendered HelmRelease through the chart's engine, and PlatformDown is the chart's ordered teardown. fluxUp, the vendored standalone chart, the post-renderer, its generated Helm plugin and the "old meta-package" guard are gone.

Acceptance, on a fresh cluster (agentlab down && agentlab up): agentlab up in 299 s (the meta chart's helm upgrade --install --wait returned with every component Ready after 115 s) — muster, kagent, agentgateway, Backstage, mcp-kubernetes Ready (11/11 HelmReleases), kubectl get fluxinstance -A → agent-platform/flux Ready, no flux-system, the only Flux on the cluster is the chart's; platform-test, backstage-test, test, agents-test (an agent created through agent-manager → HelmRelease reconciled by the chart's engine → ready) all pass; dev-image swaps proven for muster, kagent and Backstage through postRenderers, helm upgrade without extra flags; platform-down 77 s and down 3 s, no stuck finalizers.

Found on the way and filed: giantswarm/agent-platform#305 (connectivity's kagent metrics Service selects the wrong instance label under the meta chart) and giantswarm/agent-platform#306 (a first install with kagent on and no kagent namespace deadlocks) — both carried by the lab until fixed (HACKS.md U19/U20).

Not changed: #52 (platform.apsPath/llmRouting) targets the retired vendored chart; platform.chartPath is the equivalent knob for the meta chart, and #52 needs a rebase.