[FEATURE] Cut over prepared revisions to stable ate-api resources when required (K5A)

[EItanya]

Summary

When the stable ate-api resource contracts are available and required, replace kagent's current Kubernetes ActorTemplate bridge with stable ActorTemplate and immutable ActorTemplateVersion resources.

This is an isolated backing-resource cutover, not a redesign of the compiler, prepared revisions, or public APIs.

Trigger

Start this work only after Substrate provides stable support for:

• ActorTemplate and immutable ActorTemplateVersion resources.
• Exact-version Actor creation.
• Required credential handling.
• The lifecycle and snapshot behavior needed by kagent conformance tests.

Scope

• Create one stable ActorTemplate per Harness/AgentTemplate attachment.
• Create one immutable ActorTemplateVersion per prepared revision.
• Use the Kubernetes namespace as the Atespace.
• Leave the ActorTemplate default version unset.
• Select the fixed gvisor-default SandboxConfig.
• Create Actors from the exact prepared ActorTemplateVersion.
• Store the stable backing-resource identity on prepared revisions.
• Delete the Kubernetes ActorTemplate bridge in the same cutover.
• Update integration and clean-install E2E coverage.

Preserve

• The compiler and resolved-input boundary.
• Prepared-revision hashing, retention, and latest-successful selection.
• AgentInstance, checkpoint, fork, and public API semantics.

Migration policy

Existing AgentInstances are recreated after the cutover. Do not add dual-write, backfill, or legacy compatibility paths.

Completion criteria

• All Actor creation pins an immutable ActorTemplateVersion.
• No Kubernetes ActorTemplate bridge code or resources remain.
• Clean-install preparation, lifecycle, checkpoint, and fork E2E tests pass against the stable API.

Roadmap: docs/plans/api-v2-execution-plan.md, K5A.