Add manual acceptance workflow

[IlyaasK]

Summary

• Add a manual workflow_dispatch acceptance workflow for browser-pool acceptance tests.
• Gate the workflow on repository secrets for KERNEL_API_KEY and KERNEL_PROJECT_ID.
• Preserve optional KERNEL_ALT_PROJECT_ID and KERNEL_BASE_URL support.
• Update the release checklist with the manual workflow path and a cache-bypassing local acceptance command.

Why this is v0 work

v0 needs a documented, opt-in way to run real API acceptance tests before tagging. This workflow makes that release gate repeatable without running live Kernel resource tests on every PR.

Intentionally unsupported in v0

• Acceptance tests are not added to PR or push CI.
• The workflow does not acquire, release, flush, invoke apps, fetch logs, take screenshots, open live view, or force-recover runtime state.
• No v1 resources, force_destroy, or codegen work is included.

Tests run

• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/acceptance.yml"); YAML.load_file(".github/workflows/ci.yml")'
• bash scripts/check-markdown-links.sh
• bash scripts/check-examples.sh
• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• git diff --check hypeship/v0-ci-correctness
• git diff --cached --check

Acceptance-test status

The live acceptance tests were not run locally because credentials are not present in this environment. This PR adds the manual release workflow that should be run before a v0 tag with KERNEL_API_KEY and KERNEL_PROJECT_ID configured.

Review gates

• deslop: clean, no accepted findings.
• incremental self-pr review: accepted one command mismatch and updated the release checklist to use -count=1 -timeout=30m -v; fixed.
• autoreview: clean, no accepted/actionable findings reported.
• dave-cheney-go-review: clean; workflow uses the existing Go acceptance harness without changing Go cleanup, import, or durable client semantics.
• eblog-code-review: clean; acceptance lifecycle is manual, secrets-gated, timeout-bounded, and kept out of ordinary PR CI.
• final agreement pass: clean; workflow is manual-only, secrets-gated, and uses the existing acceptance harness.

Deferred v1 issues

• Consider opt-in force_destroy for kernel_browser_pool (architecture amendment) #24 force_destroy for kernel_browser_pool.
• Generate Terraform Plugin Framework schema/model via tfplugingen-framework codegen #25 Terraform Plugin Framework code generation.

Remaining manual release gates

• Configure acceptance-test repository secrets.
• Run the manual Acceptance workflow or the documented local acceptance command before tagging v0.
• Merge the v0 stack onto the canonical branch and confirm release signing/checksum ownership before publishing.

---

Note

Low Risk
CI and documentation only; no provider or test harness logic changes, though the workflow can create real Kernel resources when triggered with valid secrets.

Overview
Adds a manual-only GitHub Actions workflow (workflow_dispatch) so browser-pool acceptance tests can run against live Kernel credentials without running on every PR.

The job sets TF_ACC / KERNEL_ACC, wires KERNEL_* secrets (required API key and project ID; optional alt project and base URL), fails fast if secrets are missing, installs Go and Terraform, and runs go test -count=1 -timeout=30m -v ./internal/resources/browserpool -run TestAcc with a 40-minute job timeout so setup does not cut off test cleanup.

docs/release.md now documents the same local acceptance command and points release maintainers at the new Acceptance workflow as an alternative to running tests locally.

^{Reviewed by Cursor Bugbot for commit 398d8e5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1b274e5. Configure here.}