Feat #1185: publish prebuilt terraform-provider packages

[ThomBogers]

Users currently have to build the OpenTofu provider from source. This adds a rolling terraform-provider-latest GitHub release, built the same way as functl-latest on every push to master. The zips use the provider-registry package layout, so dropping one unchanged into ~/.terraform.d/plugins/registry.opentofu.org/fundament/fundament/ is enough for tofu init to find it — no CLI config and no registry involvement (verified against OpenTofu 1.11.3). Publishing to the OpenTofu registry proper would need a dedicated fundament-oss/terraform-provider-fundament repo and GPG-signed semver releases; that is left as a follow-up.

• New release-terraform-provider.yml workflow: linux/amd64, linux/arm64, darwin/arm64, windows/amd64 zips + SHA256SUMS on a rolling prerelease
• Provider README: prebuilt install instructions (bash + PowerShell) and the update recipe for the fixed 0.1.0 version
• User docs opentofu-provider.md: matching Install section

Refs https://gitlab.com/digilab.overheid.nl/miscellaneous/issues/-/work_items/1185

[github-actions]

PR Environment

Service	URL
Console	https://console.pr406.fundament.digilab.reviews
Console demo (walkthrough)	https://console-demo.pr406.fundament.digilab.reviews
Authn API	https://authn.pr406.fundament.digilab.reviews
Organization API	https://organization.pr406.fundament.digilab.reviews
Kube API Proxy	https://k8s-api.pr406.fundament.digilab.reviews
Docs	https://docs.pr406.fundament.digilab.reviews
DCIM	https://dcim.pr406.fundament.digilab.reviews
DCIM API	https://dcim-api.pr406.fundament.digilab.reviews
DCIM Auth	https://dcim-authn.pr406.fundament.digilab.reviews
Marketplace Catalog API	https://marketplace-api.pr406.fundament.digilab.reviews

Commit: 5cf4cb691db18718be381808bc781fbd4013c615-406-merge-2254
Namespace: tn-fundament-pr-406

Environment will be ready once Flux reconciles (~5 min after images are built).

Test credentials (all passwords: password)

• alice@acme-corp.com (Acme Corp)
• bart@acme-corp.com (Acme Corp)
• cindy@acme-corp.com (Acme Corp)
• david@globex.com (Globex)
• emily@globex.com (Globex)
• frank@initech.com (Initech)
• grace@initech.com (Initech)

Debugging this environment

Kubeconfig and pinniped setup: see the deployment and infra docs.

1. Connect

export KUBECONFIG=~/.kube/pinniped_digikluster.yaml
export NS=tn-fundament-pr-406
kubectl -n $NS get pods

2. Flux reconciliation

kubectl -n $NS get helmrelease,gitrepository
kubectl -n $NS describe helmrelease fundament
kubectl -n $NS describe gitrepository fundament   # auth / branch / commit issues surface here

# Force a retry
kubectl -n $NS annotate --overwrite helmrelease/fundament \
  reconcile.fluxcd.io/requestedAt="$(date +%s)"

3. Pod / app state

kubectl -n $NS get pods
kubectl -n $NS get events --sort-by=.lastTimestamp
kubectl -n $NS describe pod <pod>   # readiness probes, env refs, and pod events
kubectl -n $NS logs <pod>
kubectl -n $NS logs <pod> --previous   # if the pod crashed

# Narrow to a single service (app.kubernetes.io/name = authn-api, organization-api,
# console-frontend, docs-frontend, cluster-worker, authz-worker, kube-api-proxy, dex, openfga)
kubectl -n $NS get pods -l app.kubernetes.io/name=organization-api

4. OpenFGA / authorization config

# organization-api and kube-api-proxy readiness depend on OpenFGA.
kubectl -n $NS get configmap openfga-config -o yaml
kubectl -n $NS logs -l app.kubernetes.io/name=openfga -c setup
kubectl -n $NS logs -l app.kubernetes.io/name=openfga -c openfga --tail=100

# If consumers are still using an old store/model ID after setup patched openfga-config:
kubectl -n $NS rollout restart deployment/organization-api deployment/kube-api-proxy

5. DB & migrations

kubectl -n $NS get cluster.postgresql.cnpg.io/db
kubectl -n $NS describe cluster.postgresql.cnpg.io/db

# Migrations run as a Job named db-migrations-<helm-revision>, with a
# 5m TTL after success. If the Job is gone, migrations almost
# certainly succeeded.
kubectl -n $NS get jobs -l app.kubernetes.io/name=db-migrations
kubectl -n $NS logs -l app.kubernetes.io/name=db-migrations -c migrations

# OpenFGA blocks on that Job before migrating its schema. If openfga
# is stuck in Init, this is why:
kubectl -n $NS logs -l app.kubernetes.io/name=openfga -c wait-for-reset

6. Routes & TLS

kubectl -n $NS get httproutes
kubectl -n istio-gateway get certificate tn-fundament-pr-406-wildcard-tls

7. Nothing deployed at all?

If the namespace is missing, the PR overlay never reached the cluster. Check the PR overlay in the Flux repo — if it's not there, the CI push to the Flux repo failed; if it is, the cluster-level Flux reconciliation is stuck.