feat: nullplatform_artifact + nullplatform_package resources and data sources

[sebasnallar]

What

First-class Terraform support for the packages feature (nullplatform/main-service-api#286, #288).

Resources

• nullplatform_artifact — registers a platform artifact revision via the idempotent POST /artifacts upsert. meta is a JSON object whose per-type stable subset identifies the artifact (git_repository: url; oci_image: registry+repository) and whose remaining fields pin the revision (reference, digest, …). The resource id is the revision id with artifact_id computed — both ready to wire into a package BOM. visible_to is updatable (re-register is the API's write path); everything else ForceNew. Artifacts are immutable content-addressed records the API never deletes, so destroy only forgets state.

resource "nullplatform_artifact" "scopes_source" {
  nrn  = "organization=1255165411:account=95118862"
  type = "git_repository"
  meta = jsonencode({
    url       = "https://github.com/nullplatform/scopes.git"
    reference = "1.10.0"
  })
}

• nullplatform_package — publishes a package revision through the slug-keyed PUT /packages. Bump version together with components changes to publish; default = true promotes each publish to the package default. Envelope-only changes (name) PATCH. Computed: default/latest revision ids + versions and published_revision_id.

Data sources

• data.nullplatform_artifact — read-only lookup by (nrn, type, meta): identity fields select the artifact, per-revision fields (e.g. reference) select the exact revision, identity-only resolves the latest. Never registers anything (uses the new GET /artifacts/:id/revisions).
• data.nullplatform_package — lookup by (nrn, slug[, version]) → revision ids ready for service binding / composition pins.

Housekeeping

• TestProvider_HasChild* expectations updated — the data-source list had already drifted from the registered map (asserting 6 of 10) before this change.
• Examples added under examples/ for tfplugindocs generation.

Depends on

• nullplatform/main-service-api#288 (visible_to + GET /artifacts/:id/revisions) for the data-source revision resolution and visibility fields. Resources work against current production minus visible_to.

---

Update: package release tags

nullplatform_package gains an optional tags map (name => published version), layered over default/latest via the new package_tags API (nullplatform/main-service-api#294):

resource "nullplatform_package" "app" {
  # ...
  tags = {
    beta       = "1.3.0"
    production = "1.2.0"
  }
}

Terraform manages exactly the declared tags — create/move points each name at its version, dropping a key deletes the tag. Read reflects the package's user tags (system default/latest excluded). Reserved names are rejected server-side. Adds SetPackageTag / DeletePackageTag client methods + NullOps entries.