fix(resmgr): a host being deauthorised has not gone away - #47

Two fixes, both patch-level, released as v0.1.9.

A host being deauthorised has not gone away

resmgr answers the per-host endpoints with 404 for minutes after a host's last role is
removed, while GET /resmgr/v2/hosts keeps reporting that host — its roles and its
hostconfig_id — throughout. The host has not gone anywhere.

pcd_host_config_assignment, pcd_host_cluster_role and pcd_host_role believed that 404
and removed live resources from state. The next apply then failed against the reality those
resources never left. Both downstream symptoms were observed on the lab across several runs:

• 409 HostToHostconfigConflict re-creating an assignment
• 403 HostInAuthState re-adding a role

hostRecord now cross-checks a 404 against the host list, and only a host absent from both
leaves state. An unreadable list is an error, never an absence — dropping a live resource on an
unverified 404 is the whole thing being prevented. An ordinary read still costs one request;
the extra call happens only on the 404 path.

Applied to all three read paths. If resmgr ever stops 404ing a host it still lists, this
degrades to the fast path and can be retired.

gRPC 1.82.0 -> 1.82.1

Clears the open HIGH dependabot alert (gRPC-Go xDS RBAC and HTTP/2 vulnerabilities). Indirect
dependency; the provider's gRPC server only ever serves the local Terraform CLI over a private
channel and does not use xDS, so real exposure was minimal.

Testing

Static gate green: build, vet, gofmt, golangci-lint 0 issues, all 11 packages' unit tests.

New unit tests cover the window from both sides (404 + still listed = present; 404 + absent
from the list = gone), the fail-closed path when the list cannot be read, and that the ordinary
path stays at one request.

On the evidence, stated plainly: the defect is evidenced from live lab runs (the two
errors above are in recorded logs). The fix ships on unit tests, not on a fresh live
reproduction — reproducing the window requires a deauth, which reliably triggers two open PCD
product bugs and left the lab needing a full rebuild. That trade was not worth another rebuild.

An adversarial audit of this diff raised 12 findings; 11 did not survive verification. The one
that did was a coverage gap: nothing pinned the guard that keeps a per-host failure which is
not a 404 (a 500, an expired token) from being reported as an absence. The shipped code was
correct — all three callers check err before known — but the guard could be deleted with the
suite staying green. Mutation-tested and now covered.