docs(fork): ledger — the line is pinned at kagent-dev/substrate v0.0.29 and runs the agentgateway line's v1.5.1-gs.4; release v0.0.30-gs.1

[teemow]

FORK.md after the 2026-09-14 re-pin (giantswarm/giantswarm#37742, #37757), the second step of the three-line move (agentgateway → Substrate → kagent):

• Pin: kagent-dev/substrate v0.0.29 (463f483c; the go/go.mod replace of upstream kagent main since chore: upgrade Substrate to v0.0.29 kagent-dev/kagent#2802, whose a2a gateway addresses an actor by the ate-target-actor header). Dev base 0.0.30, release v0.0.30-gs.1 after the agentlab proof.
• agentgateway it runs: the agentgateway line's v1.5.1-gs.4 (upstream main @ c1d24607, ≥ 9f9744cf — #3237/#3318/#3409/#3428), pinned in publish.yaml and the chart default together.
• Carried patches: fix: Helm-installed atelet cannot prewarm sandbox assets kagent-dev/substrate#33 fell away (af7d1539 in v0.0.29); the chart half of chart: authorize the egress actor as a frontend policy at CONNECT time — the line's dataplane (agentgateway#3237) reads it there #9 fell away (upstream docs(fork): ledger — the ServiceAccount annotations and ate-api-server extraEnv keys (#27) as the tenth carried patch; release table v0.0.27-gs.8 #28 made the frontend-policy move under #3318's name, substrateEgressActorResolution) — what remains of chart: authorize the egress actor as a frontend policy at CONNECT time — the line's dataplane (agentgateway#3237) reads it there #9 is fork infrastructure (the publish drift check, the image comment); the ten behavioural patches replayed, their giantswarm SHAs refreshed in the table; the terminate patch hand-merged with upstream Name the gvisor root container as "_pause" so no actor container can collide with it agent-substrate/substrate#1496/ateom-gvisor: drop -direct from runsc restore agent-substrate/substrate#1549; the bounded-restore patch now also passes its budget in upstream's new workflow_delete_test.go (Stop leaking in-progress snapshots after worker deletion agent-substrate/substrate#1541). Fork infrastructure: the suites also run on sync/** pushes (a rebased candidate has no merge ref, a pull request from it runs nothing).
• Re-pin section: the order of the three lines, the sync-branch CI, the manual equivalent.
• Release row v0.0.30-gs.1: added once the tag's publish run has its digests.

The candidate sync/20260914-v0.0.29 ran green on run-tests (unit + kind e2e) and govulncheck (run 34889231484); helm-e2e was red only on ImagePullBackOff of the router/egress until the agentgateway v1.5.1-gs.4 image existed and was re-run. Force-pushed onto giantswarm as 21027aa1.