- Add Fleet-managed upgrades and rollback for Windows FIPS agents and enable Private Action Runner split mode via MSI property.
- Security updates: bump embedded pip to 26.2.1 and harden MIT krb5 library token parsing to reject malformed inputs.
- Bug fixes: resolve Kueue pod tag loss after restarts, enforce matching Windows/FIPS installer versions, and improve Cluster Agent namespace metadata collection for on‑demand APM instrumentation.