Document deployment resource release gate

[IlyaasK]

Summary

• define the durable kernel_deployment lifecycle and the direct-GET boundary for its data source
• specify bounded Create polling, partial-state recovery, idempotent Delete, write-only secret keepers, and metadata-only import
• record the tagged SDK and API readback blockers that prevent safe resource implementation
• omit force because the API currently forwards it into the deployment workflow but the workflow does not consume it
• align architecture and release security wording with computed inspection metadata and write-only secrets

Why this is v1 work

This is the deployment state-design gate required before implementation. It keeps Terraform limited to durable desired state and prevents provider code from guessing missing API/SDK semantics.

Intentionally unsupported

• no deployment resource implementation yet
• no local archive deployment source
• no deployment force argument until the API behavior is implemented and tested
• no SSE/event/log consumption
• no app invocation or other runtime operations
• no fallback HTTP client or generated SDK patch

Verification

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-markdown-links.sh
• git diff --check hypeship/proxy-resource-contract

Acceptance tests were not run because this PR changes documentation only and deliberately does not implement deployment behavior.

Remaining upstream gates

• tagged SDK exposure of deployment source provenance
• direct deployment GET readback for version, app name, and actions
• authoritative deletion signal from deployment GET
• functional and tested API overwrite behavior before reconsidering force
• process-level Terraform proof of partial Create state during implementation

---

Note

Low Risk
Documentation-only changes with no runtime or provider code impact.

Overview
Documentation-only PR that locks in the deployment resource gate and tightens architecture/release wording around durable state vs secrets.

kernel_deployment is documented as core v1 but blocked until a tagged SDK exposes source provenance, the API supports deterministic durable readback, and write-only env/token plus metadata-only import are accepted. Runtime status may appear only as computed inspection metadata (not configurable, no diff drift, never from SSE/logs). The deployment data source is bounded to a durable deployment GET; app name, version, and actions stay on kernel_app until reads expose them. force stays out until overwrite behavior is implemented and tested.

Import and release security sections now align: resource state is durable desired config plus approved computed inspection fields from durable GETs only; proxy/deployment secrets are write-only (not in state), with replacement keepers and masked metadata where applicable.

^{Reviewed by Cursor Bugbot for commit b56f33f. Bugbot is set up for automated code reviews on this repo. Configure here.}