Expose browser pool resolved references

[IlyaasK]

Summary

• add computed profile_id to kernel_browser_pool
• add computed ordered extension_ids
• prefer authoritative top-level resolved IDs from the Kernel Go SDK
• accept legacy response echoes only when they contain IDs
• validate omission, nullability, element types, non-empty IDs, and list order
• update generated Registry documentation

Why this belongs in v1

This extends the read-only browser-pool data source with stable durable identities. It is additive to the v0 provider and intentionally separate from the core lookup/project-scope PR so canonical-reference semantics can be reviewed independently.

API contract and state semantics

Top-level profile_id and extension_ids are authoritative because browser_pool_config may echo name selectors supplied during creation. Authoritative fields always win. For older responses that omit them, fallback succeeds only when the echoed profile/extensions already contain canonical IDs.

profile_id omission means no profile; explicit JSON null is rejected because the SDK field is optional but non-nullable. An authoritative empty extension_ids array becomes an empty computed Terraform list. Extension order is preserved.

Intentionally unsupported in this PR

• remaining browser-pool durable scalar configuration
• viewport and Chrome policy
• runtime counters or leased/session state
• browser-pool writes
• live acceptance coverage

No v0 behavior is removed or changed.

Tests run

• go test -count=20 ./internal/datasources/browserpool
• go test -race ./internal/datasources/browserpool ./internal/provider
• go test -short -timeout=2m ./...
• go vet ./...
• test -z "$(gofmt -l cmd internal)"
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• git diff --check

Tests cover authoritative precedence, legacy ID-only fallback, profile omission, explicit null rejection, empty and ordered extension lists, malformed field types, empty IDs, and selector-name rejection.

Acceptance status

Not run in this PR. Live SDK resolved-reference responses, GET-by-name, and project scoping remain a non-blocking integration risk for the later opt-in acceptance slice.

Additional quality verification

• Gremlins: 33/33 mutants killed; targeted semantic mutations: 4/4 killed
• browser-pool data-source coverage: 90.8%; maximum CRAP score: 15.0
• Godog stack suite: 7 scenarios / 21 steps passed, including the @pr75 resolved-reference scenario

---

Note

Low Risk
Additive read-only data source attributes with validation and broad unit tests; no writes or changes to existing v0 fields.

Overview
The kernel_browser_pool data source now exposes resolved durable references as computed profile_id and extension_ids (load order preserved), documented in the registry schema.

Flattening prefers authoritative top-level profile_id / extension_ids from the API over browser_pool_config echoes (which may still carry name selectors). When those top-level fields are absent, it falls back to legacy nested profile/extension IDs only; name-only selectors are rejected. Omitted profile means null; explicit JSON null for profile is an error; malformed lists, empty IDs, and type mismatches surface as invalid-response diagnostics.

Tests cover precedence, legacy paths, omission, rejection cases, and schema/state wiring; existing lookup behavior is unchanged.

^{Reviewed by Cursor Bugbot for commit 5721458. Bugbot is set up for automated code reviews on this repo. Configure here.}