Entitle Agent — image pull failures on new deploys / restarts

This incident is resolved. We've re-enabled the connection to the agent image registry, so image pulls are working as before.
Agents that failed to start during the incident just need a rollout — trigger a rollout (restart) of the agent and it will pull the image successfully, exactly as before. No token changes or reinstall are required. Agents that were already running were not impacted.

Agents that are newly installed, upgraded, or restarted during this window may fail to start. The agent's container image cannot be pulled because the image-registry credentials issued with agent tokens have expired, causing image-pull (authentication) failures — the agent pod stays in a non-running state.