Flatten resolved browser pool references

[IlyaasK]

Summary

• flatten browser-pool profile_id from the authoritative resolved API field
• flatten ordered extension_ids from the authoritative resolved API field
• retain compatibility with legacy responses whose selector echoes contain IDs
• preserve Terraform null versus explicit-empty-list intent
• reject malformed authoritative reference fields instead of hiding contract errors

Why

Terraform state must contain stable durable identities. Browser-pool configuration
echoes can contain names, while Kernel now returns canonical resolved profile and
extension IDs separately. Reading those resolved fields prevents selector names
from entering state and producing drift.

Scope

This changes only kernel_browser_pool response flattening and focused unit tests.
It does not add a browser-pool data source or change schema, mutations, deletion,
import, or runtime behavior.

Terraform state semantics

• profile_id stores the canonical resolved profile ID when present
• extension_ids stores canonical resolved extension IDs in API order
• omitted resolved fields fall back to legacy selector echoes
• explicit null or malformed resolved fields fail refresh
• an authoritative empty extension list preserves prior null/empty configuration intent

Tests run

• gofmt -l cmd internal
• go test -short -timeout=2m ./internal/resources/browserpool
• go test -race -short -timeout=2m ./internal/resources/browserpool
• go test -short -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• git diff --check origin/main...HEAD

Acceptance status

Live acceptance was not run because credentials are unavailable. Browser-pool
acceptance against the final release commit remains a release gate.

Intentionally unsupported

• browser-pool data source
• force deletion
• acquired or available runtime counters in Terraform state
• browser acquire/release/flush, sessions, logs, screenshots, or live view

---

Note

Medium Risk
Changes only read-path flattening for kernel_browser_pool state, but wrong ID sourcing would cause refresh drift or failed applies; scope is limited to flatten logic and unit tests.

Overview
Browser pool refresh now writes profile_id and extension_ids from the API’s top-level resolved fields (profile_id, extension_ids) instead of config selector echoes that may only carry names. That keeps Terraform state on stable IDs and avoids drift when echoes differ from resolved references.

When those resolved fields are absent, flattening still uses legacy browser_pool_config.profile / extensions ID echoes. Malformed or explicit-null resolved values surface refresh errors rather than silently falling back. An authoritative empty extension_ids list still honors prior null vs explicit-empty extension_ids intent in state.

Tests were updated and expanded for resolved-vs-legacy behavior and invalid resolved reference handling.

^{Reviewed by Cursor Bugbot for commit c7c576d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c8beaf5. Configure here.}