Test extension data source against Kernel

[IlyaasK]

Summary

• upload a uniquely named Chrome extension fixture through the durable Kernel SDK
• test kernel_extension lookup by canonical ID and exact name
• test explicit resource scope and provider-default project scope
• verify durable creation metadata and require an empty follow-up plan
• recover uncertain uploads by unique name so cleanup can still be registered
• add the extension data-source package to the manual acceptance workflow

Why this is v0 work

This closes the live coverage gap for the existing v0 kernel_extension data source. The fixture is created and deleted through durable SDK operations, with no dependency on the parked Terraform extension resource.

Tests

• go test -short -timeout=2m ./...
• go test -race -short -timeout=2m ./internal/datasources/extension ./internal/acctest ./internal/kernelclient
• focused archive and uncertain-upload recovery unit tests
• opt-out test proving acceptance skips before network access
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-markdown-links.sh
• bash scripts/check-docs.sh
• git diff --check
• gofmt -l cmd internal

Acceptance status

The live API path was not run locally because KERNEL_API_KEY and KERNEL_PROJECT_ID are unset. It is available through the manual Acceptance workflow and requires TF_ACC=1, KERNEL_ACC=1, KERNEL_API_KEY, and KERNEL_PROJECT_ID.

Intentionally unsupported

• no Terraform extension resource
• no extension import or content replacement
• no extension download or Chrome Store operations
• no runtime usage metadata in Terraform state
• no browser/session runtime operations

---

Note

Low Risk
Test-only changes against live API in opt-in acceptance runs; no provider runtime or auth logic changes.

Overview
Adds live acceptance tests for the existing kernel_extension data source and registers that package in the manual Acceptance workflow matrix (project ID required).

Tests upload a minimal Chrome extension ZIP via the Kernel SDK, then assert data.kernel_extension lookups by canonical ID (with explicit project_id) and by name (provider-default project scope), including created_at, size_bytes, and absence of last_used_at. A plan-only step checks for an empty follow-up plan.

Fixture setup includes recovery by unique name when upload responses are ambiguous, plus cleanup registration and post-test verification that extensions are deleted. Unit tests cover the ZIP fixture shape and recovery behavior (found, not found, server error, empty response).

^{Reviewed by Cursor Bugbot for commit 8ed2a6c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d360e8d. Configure here.}