Add browser pool profile refresh policy

[IlyaasK]

Summary

• expose the durable refresh_on_profile_update browser-pool policy as an optional/computed Terraform attribute
• map explicit values through Kernel Go SDK v0.76 create and update parameters
• preserve the prior API value during unrelated updates without overriding Kernel's default when a profile is attached, changed, or removed
• flatten the API value into state and validate that true requires profile_id
• retain Tighten browser pool update boundaries #115's browser-pool update-boundary behavior while removing the dropped browser-pool data-source ancestry

Why

Kernel's API and Go SDK already support this durable browser-pool setting. Terraform should manage the same desired state as the CLI without introducing browser-pool runtime operations.

The resource keeps an explicitly configured false value when a profile changes. When the attribute is omitted, profile attachment, replacement, or removal leaves the value to Kernel's profile-dependent default. Unrelated updates preserve the value already read from the API and avoid a noisy unknown plan.

Intentionally unsupported

This does not add a browser-pool data source, browser acquire/release/flush operations, leased-browser state, force deletion, profile mutation, or any other runtime/session behavior.

Verification

• gofmt -l cmd internal
• go test -short -timeout=2m ./...
• go vet ./...
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-markdown-links.sh
• structured Codex autoreview completed clean after fixes for profile removal, attachment, and replacement planning
• focused tests cover explicit false on create, enable/disable patches, unchanged omission, profile-dependent defaults, profile removal, validation, response flattening, malformed responses, and acceptance state assertions

Live acceptance was not rerun for this history-only restack. The browser-pool acceptance workflow remains the final live gate after the resource stack is assembled.