gates: the newest release header must state its MinAgent; backfill v0.233.0-v0.236.0 (R-470, R-472)

From hub v0.112.0 a floor above the golden is served only with a declared
MinAgent, read from this CHANGELOG's newest `## vX.Y.Z` header. New fast,
blocking gate minagent_header_gate.py: that block must contain a line
starting `**MinAgent: X.Y.Z**`; prose, a code span or a non-bold mention
does not count (decoy test; red-proof F: relaxing the match to a body
mention fails test_decoy_body_mention_is_not_the_line).

Backfill: v0.233.0, v0.234.0, v0.235.0 and v0.236.0 carried no MinAgent
line. Each now reads `**MinAgent: 0.129.0** (unchanged)`, the value of the
nearest earlier header (v0.232.0). Proof it did not move: zero commits
under controller/internal/agentapi since 2026-09-01 (last: bb50e12,
2026-08-14), and the highest featureMinAgent entry is 0.129.0.

CHANGELOG.md

@@ -113,6 +113,8 @@ to fail** — three first ran INERT or did not compile and were fixed before the
 
 ## v0.236.0 — "delete my data too" deletes the data, or says that it could not (2026-09-13, R-442)
 
+**MinAgent: 0.129.0** (unchanged) — backfilled 2026-09-13 (R-470): read from v0.232.0's header; `internal/agentapi/` has no commit since 2026-09-01
+
 **The defect.** A customer removes an app and ticks *also delete my data*. The box says it worked;
 **the data is still on the disk** — measured 2026-09-01 on demo-hp: `HTTP 200` with
 `hdd_paths_removed: null, hdd_paths_preserved: null` and 128 MB of Nextcloud left at
@@ -162,6 +164,8 @@ metrics) — left alone; not deleted here.
 
 ## v0.235.0 — freeze the version, keep the fixes flowing (2026-09-06, update arc slice 3)
 
+**MinAgent: 0.129.0** (unchanged) — backfilled 2026-09-13 (R-470): read from v0.232.0's header; `internal/agentapi/` has no commit since 2026-09-01
+
 **OPERATOR RULING, 2026-09-06 — Option 1.** R-447 was `BLOCKED` because R-438 established that
 `RestartStack`'s use of `up -d` to pick up template changes was **chosen** and written down in its own
 comment; reversing a chosen behaviour is a decision, not a bug fix. The decision is made and this
@@ -273,6 +277,8 @@ catalog. `TestRenderTable_EmptyStoredDefinitionIsTreatedAsAbsent`.
 
 ## v0.234.0 — the label now appears on an app nobody has touched (2026-09-03, update arc slice 1b)
 
+**MinAgent: 0.129.0** (unchanged) — backfilled 2026-09-13 (R-470): read from v0.232.0's header; `internal/agentapi/` has no commit since 2026-09-01
+
 **Found by the operator on demo-felhom the morning after v0.233.0, and it is a real gap, not a
 misunderstanding:** OpenGist had been up 15 hours, was running exactly what the catalog pins, and
 showed **no badge at all**. v0.233.0 wrote the record only from the four bring-up paths, so an app
@@ -326,6 +332,8 @@ a backfill nothing invokes seeds nothing, and a `strings.Contains` would match a
 
 ## v0.233.0 — the box writes down what it installed, and one label says whether it is current (2026-09-02, update arc slices 1 & 2)
 
+**MinAgent: 0.129.0** (unchanged) — backfilled 2026-09-13 (R-470): read from v0.232.0's header; `internal/agentapi/` has no commit since 2026-09-01
+
 **Neither slice changes any behaviour.** The Frissítés button, the restart path, the sync and the boot
 reconciler are byte-identical. This adds a RECORD and a LABEL, because the behaviour work (slice 3)
 is easier to judge once the fleet's real state is visible. Opened by