Adopt the accepted KSail release interface after its runtime gate is retired #4874

🤖 Generated by the Agentic Engineer

Part of devantler-tech/khoist#373

Problem

The accepted public KSail release interface still has its temporary first-use runtime gate. Source issue devantler-tech/khoist#385 removes it in a breaking release, but Platform's rollout verifier currently requires the legacy environment setting. Adopting that release without a compatible verifier would refuse a healthy deployment.

Outcome

Adopt the verified signed retirement release through normal GitOps and prove the public product still works, while retaining an explicit way to unlist its optional catalogue entry.

Acceptance criteria

• Verify the new source release, successful required publishing/smoke jobs and exact image/chart signatures, source revision and immutable digests before selecting artifacts.
• Keep the current legacy runtime-gate checks for legacy artifacts. For the explicitly bound retired-gate profile, require the obsolete setting to be absent from Deployment, current ReplicaSet and every serving Pod; do not accept a missing setting for arbitrary artifacts or silently permit duplicate/indirect declarations.
• Keep optional DataProduct publication bound to declared/live Helm values, current registration and exact public source, UI and contract identities. Unlisting withdraws the catalogue entry while the standard direct routes remain available.
• Preserve current generation, replica, route, digest, signature, sandbox, presentation and source/network boundaries. Keep publisher activation on the independent UI host and preserve its withdrawal checks.
• Update the chart-render rules, rollout regressions and operator guide for both artifact profiles, absence/mismatch failures, optional unlisting and recovery through a previously verified legacy release.
• Pin the four components and chart consistently, pass full required CI and exact-head review, merge through the normal queue, and verify installed chart and actual runtime digests after reconciliation.
• Use the existing authenticated browser path to connect from the registry, read current public releases, exercise local filters and explicit refresh, verify Light/Dark and fresh-history behavior, and read the independent surface. Do not induce a production source outage or claim private connector acceptance.

Source delivery and its signed published artifact are prerequisites. Publisher Platform PR #4871 must be terminal before this follow-on changes the same deployment pins. Parent #373 remains open until this consumer adoption and live readback finish.