Explain canonical project import IDs

[IlyaasK]

Summary

• identify both Kernel's canonical project ID and Terraform's current state ID
• explain recovery when a project was imported by name
• preserve the existing identity-mismatch guard instead of silently retargeting state
• cover the imported-name lookup and complete diagnostic in focused tests

Why

Kernel project GET accepts an ID or name, but Terraform import requires a stable
canonical ID. Importing by name can therefore resolve successfully and then hit
the provider's identity-mismatch guard. The diagnostic now reports the canonical
ID and explains how to import it.

This is a provider-only usability change. It does not require an API or SDK
change and does not expand the project resource contract.

Terraform semantics

• no remote mutation is added
• no state ID is rewritten automatically
• the existing Read diagnostic path preserves prior state
• canonical-ID imports continue to settle through Read

Tests run

• gofmt -l cmd internal
• go test -short -timeout=2m ./internal/resources/project
• go test -race -short -timeout=2m ./internal/resources/project
• go test -short -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• git diff --check origin/main...HEAD

Acceptance tests were not run because the change only affects a deterministic
local diagnostic and adds no live API behavior.

Intentionally unchanged

• no API or SDK changes
• no permissive name-based import support
• no automatic state removal or identity migration
• no runtime or session operations

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1530b0b. Configure here.}