Wire extension metadata into Terraform Read

[IlyaasK]

Summary

• adapt the extension Read core to Terraform Framework request and response state
• decode prior state before any client call
• write refreshed durable state only after a clean Read result
• remove the resource only when the core confirms coded extension not-found
• leave pre-populated state untouched on diagnostics
• cover refresh, removal, diagnostic preservation, and malformed-state no-call behavior

Why this is v1 work

This is the narrow Framework state-transition boundary over the already-reviewed metadata Read core. It keeps registration and incomplete Delete/Import behavior out of the PR.

Intentionally unsupported

• no registered kernel_extension resource
• no Delete or Import behavior
• no archive download or Chrome Web Store operation
• no browser/session/runtime operation
• no runtime fields in Terraform state

Verification

• gofmt -l cmd internal
• go test -count=20 ./internal/resources/extension
• go test -race -count=1 ./internal/resources/extension
• go test -count=1 -short -timeout=2m ./...
• go vet ./...
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check

All commands passed locally. Tests are fake-client based, deterministic, and require no network or container.

Acceptance status

The resource remains unregistered and lacks Delete/Import, so live acceptance testing is not applicable to this adapter-only slice.

Remaining risk

The complete resource must preserve these state transitions when Create, Read, Delete, Import, Configure, and provider registration are assembled.

---

Note

Low Risk
Adapter-only slice with no provider registration; behavior is narrow state transitions over an already-reviewed read core and is fully covered by unit tests.

Overview
Adds a Terraform Plugin Framework Read handler (readExtensionResource) that bridges resource.ReadRequest/ReadResponse to the existing readExtension metadata core.

On read it decodes prior state first, then on success writes refreshed state or removes the resource when the core reports a coded not_found. Diagnostics leave response state unchanged (no partial writes).

New fake-client tests cover successful refresh, not-found removal, error preservation, and malformed state without calling the API.

^{Reviewed by Cursor Bugbot for commit d503c89. Bugbot is set up for automated code reviews on this repo. Configure here.}