Flatten extension metadata for resource state

[IlyaasK]

Summary

• flatten extension metadata into durable resource state only
• validate raw SDK identity, nullable name, and checksum fields
• preserve recorded project scope because extension metadata does not return project identity
• clear the write-only source path on every refresh
• surface remote checksum changes as Terraform drift
• tolerate an omitted checksum only for legacy or otherwise unmanaged imported state
• diagnose loss of checksum evidence for provider-created or checksum-managed extensions
• exclude creation time, archive size, last-used time, downloads, and runtime fields

Why this is v1 work

Resource Read has stricter state semantics than the existing extension data source. This pure flattener establishes durable drift and legacy-import behavior before adding the API call and Terraform Read adapter.

Intentionally unsupported

• no SDK metadata call or Terraform Read method
• no resource registration
• no Delete or Import behavior
• no archive download or Chrome Web Store operation
• no browser/session/runtime operation
• no informational or runtime fields in resource state

Verification

• gofmt -l cmd internal
• go test -count=20 ./internal/resources/extension
• go test -race -count=1 ./internal/resources/extension
• go test -count=1 -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check

All commands passed locally. Tests are pure, deterministic, and require no network or container.

Acceptance status

No API or Terraform lifecycle call is introduced, so live acceptance testing is not applicable to this pure flattener.

Remaining risk

Extension metadata does not include project identity, so Read must continue using scope recorded in Terraform state. Legacy and Chrome Web Store records may lack checksum evidence and remain metadata-only until replaced from a local managed archive.

---

Note

Low Risk
Pure, test-only state-mapping logic with no lifecycle or network calls; behavior is isolated until Read is integrated.

Overview
Adds flattenExtensionRead, a pure mapper from Kernel ExtensionGetResponse to Terraform extensionModel for future resource Read, without wiring an API call or lifecycle method yet.

It validates SDK identity, nullable name, and checksum fields; keeps project_id from prior state (API metadata does not return project scope); clears write-only source_path on refresh; and maps remote checksum into source_sha256 so drift is visible. Errors when a managed extension loses checksum evidence; allows omitted checksum for legacy/unmanaged prior state. Ignores runtime/metadata fields (timestamps, size, etc.).

Unit tests cover happy path, legacy nulls, checksum loss, remote checksum drift, and invalid responses.

^{Reviewed by Cursor Bugbot for commit a890eb5. Bugbot is set up for automated code reviews on this repo. Configure here.}