v0.1.7: block device boot sources, migration priority, port security, scheduler hints, and resmgr absence detection

[PF9-pushkar]

Everything a VM can be created from in the UI, the placement controls that need, and one
resmgr read that was quietly wrong.

Added

• block_device on pcd_compute_instance — the four boot sources the create-VM wizard offers
  and the provider could not express: boot from a new volume, from an existing volume, from a volume
  snapshot, and install from an ISO. Mirrors openstack_compute_instance_v2 so configurations port
  across unchanged. volume_type in a block-device mapping needs compute microversion 2.67, so that
  is negotiated for the create call alone — read paths keep the 2.1 response shapes they were
  written against.
• migration_priority on pcd_compute_instance — how DRR treats a VM when balancing hosts,
  stored as the migration-priority metadata key exactly as the UI's dialog does. Updatable in
  place, coexists with user metadata, and the reserved key is rejected at plan time.
• port_security_enabled on pcd_networking_network (and its data source) — with it, a Layer 2
  / "Simple" network is expressible: a provider segment, no subnet, port security off, tagged
  simple_network. Note that Nova refuses to boot on a subnet-less network by uuid, so those VMs
  attach through a pcd_networking_port; the example says so.
• scheduler_hints on pcd_compute_instance — group, different_host, same_host,
  additional_properties. pcd_compute_servergroup existed but nothing could join one.

Fixed

• availability_zone = "<az>:<host>" no longer fails with "inconsistent result after apply".
  Nova reports only the zone, so an admin's host pin was being dropped on read.

• resmgr absence detection. GET /resmgr/v2/clusters/<name> answers 200 with a body of null
  for a cluster that is gone, rather than a 404. That decoded into a zero-value struct with no
  error, so Read reported the resource as present-but-blank and never called RemoveResource —
  leaving Terraform convinced a destroyed cluster still existed, and a torn-down region impossible
  to rebuild. Fixed in the shared getJSON helper, so the blueprint, host-config and host reads get
  it too.

  Before and after, same state, same out-of-band deletion:

  pre-fix   No changes. Your infrastructure matches the configuration.
  fixed     # pcd_cluster.proof will be created
            Plan: 1 to add, 0 to change, 0 to destroy.
  

Verification

Static: go build, go vet, gofmt, golangci-lint (0 issues), unit tests across all 11
packages, make generate clean, terraform fmt -check examples/.

Live, against a two-hypervisor PCD 2026.4 CE lab: all four block-device boot sources reach ACTIVE
with the ISO landing as an IDE cdrom (confirmed in libvirt); migration priority round-trips
including an out-of-band UI change showing as drift; port security false → true → false → omitted;
the L2 network classified as Layer 2 by the UI's own rule; and the full zero-to-hero path — empty
region to blueprint, cluster, host configs, four converged roles, image, flavour, VM, volume and a
ping — in 8m54s with a clean plan afterwards.

The absence-detection fix and the import gap it sits next to were both found by the new pre-PR
regression suite on its first live run. The import gap is tracked as #44 and is not addressed here.