Add release and security checklist

[IlyaasK]

What changed

• Added terraform-registry-manifest.json with Terraform Plugin Framework protocol ["6.0"].
• Added docs/release.md with release, Terraform Registry, GoReleaser, signing/checksum, and security/state review checklists.
• Updated docs/teach.md with the release/security lesson.

Intentionally unsupported

• No browser/session runtime operations: acquire, release, flush, app invocation, logs, screenshots, live view, or force recovery.
• No Terraform resources for API keys or projects.
• No release automation, GoReleaser config, GitHub release workflow, or signing-key material in this PR.
• No Docker build or container release path; the provider ships as a Go plugin binary.

Tests run

• jq . terraform-registry-manifest.json >/dev/null
• bash -n scripts/check-docs.sh
• terraform fmt -check -recursive examples
• GOCACHE=/private/tmp/terraform-provider-kernel-ci-go-cache go test -short -timeout=2m ./...
• GOCACHE=/private/tmp/terraform-provider-kernel-ci-go-cache go vet ./...
• git diff --check ci-checks
• bash scripts/check-docs.sh

Review gates

All five gates passed after the accepted autoreview fix:

• deslop
• autoreview
• thermo-nuclear-code-quality-review
• dave-cheney-go-review
• eblog-code-review

---

Note

Low Risk
Documentation and a static registry manifest only; no provider logic, credentials, or release pipeline behavior changes.

Overview
Adds terraform-registry-manifest.json declaring Terraform Plugin Framework protocol 6.0, which release assets are expected to ship as a versioned manifest derived from this file.

Adds docs/release.md, a pre-publish checklist covering CI commands, opt-in acceptance tests, registry asset naming (zips, checksums, GPG signature), GoReleaser/registry setup notes, and explicit security/state expectations (sensitive api_key, no runtime browser ops in the client, durable-only kernel_browser_pool state, force=false on delete, import behavior).

No release automation, GoReleaser config, or workflow changes are included in this diff.

^{Reviewed by Cursor Bugbot for commit 1ebeb33. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

PRs in the kernel, infra, hypeman, and hypeship repos. kernel is a ~mono repo with many logical services underneath, ensure to focus on the implicated service for the PR

Reason: PR appears to be for a Terraform provider project, not one of the monitored repos (kernel, infra, hypeman, hypeship); please opt in manually if deploy monitoring is needed.

To monitor this PR anyway, reply with @firetiger monitor this.