Wire extension deletion into Terraform

[IlyaasK]

Summary

• decode kernel_extension state in the Terraform Framework Delete boundary
• delegate deletion to the reviewed durable Delete core
• stop before the API call when Terraform state cannot decode
• propagate dependency and API diagnostics so Terraform retains ownership
• rely on Terraform's normal diagnostic-free Delete behavior to remove state
• cover identity/scope delegation, dependency propagation, and malformed-state no-call behavior

Resource scope

This PR covers only the Terraform Framework adapter for kernel_extension Delete. The resource remains unregistered until Create, Read, Delete, and Import are assembled as a complete lifecycle.

API contract notes

The underlying core issues one project-scoped SDK DELETE with mutation retries disabled. It treats coded extension not_found as converged success and coded HTTP 400 resource_in_use as a durable browser-pool dependency. This adapter does not duplicate that policy.

Terraform state semantics

A diagnostic-free Delete lets Terraform remove state automatically. Any malformed state, dependency conflict, project failure, transport failure, or generic API error returns diagnostics, so Terraform keeps the canonical ID and retries later.

Sensitive fields

This slice introduces no sensitive fields and never reads, stores, or logs archive bytes, API keys, credentials, or runtime data.

Import behavior

Import is intentionally unchanged in this PR and will land as a separate reviewed slice before resource registration.

Verification

• gofmt -l cmd internal
• go test -count=20 ./internal/resources/extension
• go test -race -count=1 ./internal/resources/extension
• go test -count=1 -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check

All commands passed locally. Tests are fake-client based, deterministic, network-free, and container-free.

Acceptance status

No registered complete resource exists yet, so live acceptance testing is not applicable to this adapter-only slice. Extension acceptance remains a required pre-release gate after registration.

Deferred concerns

• no force delete or implicit browser-pool/runtime cleanup
• extension upload still lacks API idempotency keys
• Import and full resource registration remain separate stack layers

GitHub issues

This PR does not resolve #24 or #25. Force-delete remains intentionally excluded, and provider code remains handwritten under the documented codegen decision.

---

Note

Low Risk
Adapter-only slice with no resource registration; behavior is delegated to reviewed delete core and covered by fake-client unit tests.

Overview
Adds the Terraform Plugin Framework Delete boundary for kernel_extension: decode state from DeleteRequest, then call the existing deleteExtension core (no duplicated API policy).

deleteExtensionResource returns early on state decode errors so the API is never invoked with bad state; successful deletes rely on Terraform’s normal diagnostic-free Delete to drop state, while dependency/API errors surface as diagnostics so state is retained.

New unit tests cover project/id delegation to DeleteExtension, propagation of resource_in_use dependency messaging, and ensuring malformed state never triggers a delete call.

^{Reviewed by Cursor Bugbot for commit 6b1210f. Bugbot is set up for automated code reviews on this repo. Configure here.}