Add masked API key data source

[IlyaasK]

Summary

Add the read-only kernel_api_key data source for masked API-key metadata by canonical ID or byte-exact name. Register it with the provider, document it, add a lookup example, and include focused unit and opt-in acceptance coverage.

Scope

This PR adds one data source only. It does not add an API-key resource, create/rotate actions, runtime operations, or direct HTTP fallback code.

API contract

The tagged Kernel Go SDK v0.76.0 exposes organization-scoped masked Get and paginated List methods. List query is substring matching, so the provider scans every non-deleted result page, deduplicates canonical IDs, applies byte-exact name equality, and reports zero or multiple matches instead of selecting by list order. Provider project_id is deliberately not sent to these organization endpoints.

Terraform state semantics

The data source accepts exactly one of id or name. State contains canonical identity, masked key metadata, optional project metadata, timestamps, and creator metadata. Deleted keys and malformed API responses are rejected. Expired but non-deleted keys remain readable according to the API status contract. Data sources do not support import.

Sensitive data

masked_key is marked sensitive. Plaintext values returned by fixture creation are never used, logged, placed in Terraform configuration, or stored in state. No rotate method is exposed by the provider wrapper.

Verification

• gofmt -l cmd internal
• go test -short -count=1 -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh

The opt-in acceptance test creates a uniquely named project-scoped key with an organization-wide administrative credential, reads it by ID and exact name, verifies masked/no-drift state, deletes it, and verifies coded absence. It was not run locally because live credentials are unavailable; it remains a manual release gate.

Deferred concerns

The kernel_api_key resource remains blocked on replayable Create/Rotate idempotency and a reliable way to prevent managing or deleting the key currently authenticating Terraform. Those blockers remain documented in docs/api-key-state.md.

This PR does not resolve a GitHub issue.

---

Note

Medium Risk
Introduces organization-scoped credential metadata reads and sensitive masked state, but read-only with no plaintext or rotation; main risk is lookup/pagination correctness and ambiguous name handling after rotation.

Overview
Adds the read-only kernel_api_key data source so Terraform can resolve masked API-key metadata by canonical id or byte-exact name (exactly one selector). State exposes identity, project metadata, timestamps, creator fields, and sensitive masked_key only—no plaintext key or rotation/resource fields.

Name lookup uses the SDK’s substring list query with active status, walks all pages, deduplicates by ID, applies byte-exact name equality (workaround until an exact-name list filter ships), and errors on zero or ambiguous matches. internal/kernelclient adds org-scoped Get/List (no provider project_id header on these endpoints) plus Create/Delete for acceptance fixtures; Rotate stays unexposed.

The provider registers the data source; docs, changelog, migration notes, examples/lookups, generated schema docs, and the manual acceptance workflow matrix are updated accordingly. Unit and opt-in acceptance tests cover pagination, ambiguity, malformed responses, and live ID/name reads with cleanup.

^{Reviewed by Cursor Bugbot for commit f3c4de0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5b55393. Configure here.}