Add kernel_app data source

[IlyaasK]

Summary

Adds the kernel_app data source as a read-only exact lookup for an existing Kernel app version.

• Registers kernel_app with the provider.
• Adds a durable SDK wrapper method for paginated app listing.
• Resolves app versions by exact app_name and version.
• Exposes app-version ID, deployment ID, region, action names, and environment-variable keys.
• Adds focused client, lookup, schema, state, pagination, ambiguity, malformed-response, and project-scope tests.
• Adds generated Terraform docs and extends the lookup example.

Why this is v1 work

The v1 architecture treats apps as read-only lookup targets because Kernel app versions are produced by deployments rather than managed as independently mutable durable objects. Invocation, logs, and other runtime operations remain outside Terraform.

Data-source scope

This PR adds only kernel_app. It does not add an app resource, deployment lifecycle behavior, app invocation, logs, runtime status, or browser/session operations.

API contract

The Kernel SDK app list operation supports exact app_name and version filters and offset pagination. The API lists app versions attached to running deployments and can return duplicate rows for the same app-version ID, so the data source scans all pages, deduplicates by canonical ID, and diagnoses zero or multiple distinct matches.

The API may return env_vars: null when no environment variables are configured. That is normalized to an empty Terraform set; a missing or malformed field remains an invalid-response diagnostic.

Terraform state semantics

Required lookup inputs are app_name and version. Optional project_id follows the established precedence: data-source override, provider default, then API-key project binding.

Computed state contains only stable lookup metadata:

• id
• deployment_id
• region
• actions as a set of action names
• env_var_keys as a set of names

Set semantics prevent ordering-only diffs. Action schemas, deployment status, and runtime fields are intentionally omitted.

Sensitive field handling

Environment-variable values are never exposed in the schema or Terraform state. Tests use non-placeholder secret values and verify that only names reach state. Action input/output schemas are also omitted.

Import behavior

Not applicable: this is a data source and owns no remote object.

Verification

Before this change, provider registration had five data sources and no kernel_app schema. After this change, registration exposes six data sources and the framework read test resolves an app while retaining only permitted metadata.

Passed locally:

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-markdown-links.sh
• git diff --check hypeship/deployment-resource-contract

Acceptance status

No live acceptance test is included. Kernel app versions are created through deployment workflows, so this data source cannot independently arrange its fixture without crossing into the separate deployment resource scope. Fake-client, SDK transport, and Terraform Framework state tests cover the lookup contract. A live lookup remains part of the deployment/app acceptance matrix once deployment fixtures exist.

Deferred concerns

• Deployment lifecycle support remains in its separate resource stack.
• App availability is currently coupled to running deployments by the API list contract.
• App mutation, invocation, logs, and runtime status remain intentionally unsupported.

GitHub issues

This PR does not resolve an existing GitHub issue.

---

Note

Low Risk
Read-only data source with no resource lifecycle; env var values are explicitly excluded from state and covered by tests.

Overview
Adds a kernel_app data source so Terraform can resolve a running app version by exact app_name and version, with optional project_id using the same precedence as other lookups.

The provider wires in paginated ListAppPage on the shared client (exact API filters + offset headers). The read path scans all pages, deduplicates by app-version ID, and errors on zero or multiple distinct matches. State exposes only stable metadata—id, deployment_id, region, action names, and env_var_keys (never env values or action schemas).

Docs, the lookups example, and unit tests cover registration, pagination, ambiguity, malformed API fields, and project scoping.

^{Reviewed by Cursor Bugbot for commit 13d3216. Bugbot is set up for automated code reviews on this repo. Configure here.}