feat(substrate): install Substrate from the Giant Swarm line (ghcr.io/giantswarm/substrate)

[teemow]

The lab's Substrate — substrate-crds and substrate charts, the control-plane images and the preloaded gVisor worker image — comes from the Giant Swarm line of Agent Substrate, giantswarm/substrate branch giantswarm (tracking giantswarm/giantswarm#37757, epic giantswarm/giantswarm#37705): upstream kagent-dev/substrate v0.0.26 (the version the dev channel's kagent pins in its go.mod) plus the cherry-picked kagent-dev/substrate#33, published by the fork's own workflow as multi-arch images and charts under ghcr.io/giantswarm/substrate with dev versions <next upstream patch>-dev.giantswarm.<date>.<time>.h<sha7>. Its FORK.md is the ledger (pin, carried patches, re-pin procedure, digests).

• internal/lab/substrate.go: substrateChartsRepo → oci://ghcr.io/giantswarm/substrate/helm, substrateImageRegistry → ghcr.io/giantswarm/substrate, substrateVersion → 0.0.27-dev.giantswarm.2026-09-10.19-33-37.h734ec53; the fork tags images with the bare version, so ateomGVisorImage drops the v prefix.
• docs/platform.md, internal/config/config.go, substrate-values.yaml.tmpl: name the line instead of upstream.
• The CA/JWT bootstrap port (substratepools.go) is unchanged — the pool wire format is the same at this pin.

The version moves only together with kagent's Substrate pin (a re-pin of the line), as a deliberate bump here.

Verification: a fresh isolated lab (configure --defaults --chart-branch poc/kagent-main, up) from published artifacts only with this binary — platform-test, test, backstage-test, agents-test, toolsets-test, models-test — and ate-system running only ghcr.io/giantswarm/substrate/* images (plus the chart's third-party postgres/rustfs/coredns/busybox/aws-cli). Results follow in this PR before it merges.

[teemow]

Verified on a fresh isolated lab (~/substrate-lab: cluster substrate-lab, own ports), agentlab built from this branch, published artifacts only — configure --defaults --chart-branch poc/kagent-main resolved agent-platform 3.22.1-dev.poc-kagent-main.2026-09-10.20-05-41.h91af653 (giantswarm/agent-platform#347, the fork worker image), up in 7m29s with every HelmRelease Ready.

Proof	Result
platform-test	PASS
test	PASS
backstage-test	PASS
agents-test	PASS — AgentTemplate Ready on Harness kagent, i.e. an actor booted on the fork's gVisor worker
toolsets-test	PASS — incl. the live turn through kagent as admin and dev
models-test	PASS

Substrate: releases substrate and substrate-crds at 0.0.27-dev.giantswarm.2026-09-10.19-33-37.h734ec53 (deployed); WorkerPool kagent/kagent-default → ghcr.io/giantswarm/substrate/ateom-gvisor:0.0.27-dev.giantswarm.2026-09-10.19-33-37.h734ec53, four workers Running on it. Images running in ate-system and podcertificate-controller-system: ghcr.io/giantswarm/substrate/{ateapi,atecontroller,atelet,atenet,podcertcontroller}:0.0.27-dev.giantswarm.…h734ec53 and the mirrored ghcr.io/giantswarm/substrate/agentgateway:c0f5597c7cb8, plus the chart's third-party postgres, rustfs, aws-cli, coredns, busybox. kubectl get pods -A -o jsonpath='{..image}' | grep -c kagent-dev/substrate → 0.