Add durable extension client methods

[IlyaasK]

Summary

• expose project-scoped extension upload and delete through internal/kernelclient
• disable SDK retries for both mutations so an ambiguous response cannot trigger a duplicate upload or repeated delete
• keep extension archive download and Chrome Web Store download outside the provider-local client surface
• extend the existing mutation contract test to prove method, path, project scope, retry count, and one-request behavior

Why this is v1 work

This is the thin durable SDK boundary needed by the planned kernel_extension resource. It adds no Terraform resource registration or lifecycle behavior yet, keeping the stacked change independently reviewable.

Intentionally unsupported

• archive download
• Chrome Web Store download
• runtime browser/session operations
• SDK fallback HTTP calls
• automatic recovery from an upload response lost after the server commits

Verification

• gofmt -l cmd internal
• go test -count=20 ./internal/kernelclient
• go test -race -count=1 ./internal/kernelclient
• go test -count=1 -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check HEAD

No live acceptance test is needed for this client-boundary slice; request behavior is verified with an in-process HTTP transport.

---

Note

Low Risk
Client-wrapper and test-only changes with no Terraform resources or auth/data-path changes; mutation no-retry behavior matches existing patterns.

Overview
Adds project-scoped extension upload and delete on internal/kernelclient.Clients, mirroring other durable mutations (e.g. browser pools).

UploadExtension posts to /extensions with ExtensionUploadParams; DeleteExtension deletes /extensions/{id}. Both use scope(projectID, noMutationRetries()) so ambiguous failures cannot trigger duplicate uploads or repeated deletes.

Extends the mutation contract table test for method, path, project header, retry count 0, and single-request behavior. Adds a reflect test that DownloadExtension and DownloadExtensionFromChromeStore are not exposed on Clients, keeping archive/Chrome Web Store download off this boundary for the planned kernel_extension resource slice.

^{Reviewed by Cursor Bugbot for commit 2daf666. Bugbot is set up for automated code reviews on this repo. Configure here.}