Test the extension lifecycle against Kernel

[IlyaasK]

Summary

• add an opt-in kernel_extension Terraform acceptance lifecycle test
• create a small valid Manifest V3 ZIP and verify create/read, stable plan, import, checksum-driven replacement, old-object deletion, and final delete
• register independent cleanup for every canonical extension ID observed in state
• add the extension package to the manual acceptance workflow matrix
• update README and release guidance for the now-supported resource and its release gate

Why this is v1 work

A production-ready durable resource needs proof against the real Kernel API, not only fake-client unit tests. This PR adds that proof without running network tests in normal PR CI and without expanding Terraform into browser/session runtime operations.

Resource scope

Only kernel_extension acceptance coverage and shared acceptance cleanup are added. Provider schema and lifecycle behavior are unchanged.

API contract notes

• upload uses a valid Manifest V3 ZIP
• replacement is driven by a changed exact-byte SHA-256 checksum
• delete uses the existing durable non-force extension delete operation
• a replaced canonical ID must return 404 within a bounded 30-second check

Terraform state semantics

• source_path remains write-only and is never asserted from state
• source_sha256, canonical id, durable name, and resolved project_id are verified
• import settles metadata, persists state, and must produce a stable subsequent plan
• replacement must produce a new canonical ID and remove the old object

Sensitive fields

No secret is added to Terraform configuration or state. The workflow reads the existing KERNEL_API_KEY repository secret only at execution time.

Import behavior

The acceptance test exercises bare canonical extension ID import under the provider project default. Project-qualified import remains covered by focused unit tests.

Tests run

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go test -count=20 ./internal/acctest ./internal/resources/extension
• go test -race -timeout=5m ./internal/acctest ./internal/resources/extension
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check

Acceptance status

The test compiles and remains disabled by default. It was not run against the live API locally because KERNEL_API_KEY and KERNEL_PROJECT_ID were unavailable. Before a v1 tag, run the manual Acceptance workflow or:

TF_ACC=1 KERNEL_ACC=1 KERNEL_API_KEY=... KERNEL_PROJECT_ID=... go test -count=1 -timeout=30m -v ./internal/resources/extension -run TestAcc

Deferred concerns

• the real-API acceptance run remains a release gate
• project-qualified import is unit-tested but not live-tested in this PR
• profile resource work remains blocked on a tagged Go SDK release with profile update support
• no API key, proxy, deployment, app, session, invocation, log, screenshot, live-view, force-destroy, or runtime-state functionality is added

GitHub issues

This PR does not resolve an issue. #24 force destroy and #25 code generation remain explicitly deferred/rejected by the v1 architecture.

---

Note

Low Risk
Test and documentation only; no production provider or API client behavior changes.

Overview
Adds live API acceptance coverage for kernel_extension without changing provider schema or lifecycle behavior.

A new TestAccExtensionLifecycle builds temporary Manifest V3 ZIPs and exercises create/read, stable plan, import, checksum-driven replacement (new canonical ID, old object 404 within 30s), and destroy. Shared CleanupExtension registers deletes for every extension ID seen in state, with unit tests mirroring browser pool cleanup.

The manual Acceptance workflow matrix gains the extension package (project-scoped secrets). README and release docs document kernel_extension as a supported resource, import forms, the extension go test command, and leaked-resource cleanup for extensions.

^{Reviewed by Cursor Bugbot for commit 88438e4. Bugbot is set up for automated code reviews on this repo. Configure here.}