fix(resmgr): an imported pcd_host_cluster_role plans clean

[PF9-pushkar]

Importing a pcd_host_cluster_role always left the next plan with one change:

  ~ resource "pcd_host_cluster_role" "hyp1" {
      + wait_until_converged = false
    }

and applying it re-PUT the role assignment to resmgr for a change resmgr never sees. Found while importing the CE lab's roles for the PCD-9783 destroy test (the imports had to be done with the CLI to avoid the PUTs).

Root cause

wait_until_converged is Optional + Computed + Default(false). ImportState set only id, host_id and role, and Read never touches the flag, so the imported state held null; the schema default then planned null -> false. Update PUT unconditionally, so applying that diff was a real write. lifecycle { ignore_changes } cannot suppress a provider-side default.

Change

• ImportState writes wait_until_converged = false, so the imported state already equals what the default will plan.
• Update compares the two server-side options, host_cluster and backends, between plan and prior state through a pure helper roleOptionsChanged (null and "" host cluster are the same omitted value; backends compared as ordered lists with null/unknown as "not sent" and [] as a value, mirroring what the PUT body carries). When nothing server-side changed it stores the plan and returns: no PUT, no convergence wait. A real change takes the untouched path.
• Schema unchanged, so existing states (which already hold false) see no upgrade diff. host_cluster and backends are still not read back; a configuration that sets them on an imported role plans the update it always did.
• Behavior change called out in the changelog: flipping the flag false -> true on an already-assigned role no longer re-PUTs and waits; taint or -replace to block on an existing role.

Design spec and implementation plan are committed under docs/superpowers/.

Verification

• Unit (no lab): table test for roleOptionsChanged; Update no-op test through the framework request types with a nil client, so any regression that reaches resmgr fails; ImportState tests through a schema-built tfsdk.State (the same null-root construction the framework uses).
• Acceptance (opt-in): TestAccResmgrHostClusterRoleImport, gated by PCD_ACC_RESMGR=1 and PCD_ACC_HOST_ID, creates the role, imports it with ImportStateVerify (which fails on the pre-fix provider because the imported state lacked the flag), and polls the host after destroy until the role clears. Ran green against the CE lab (2026.4, host 136fc11a, role image-library) in 65s.
• gofmt, go vet, golangci-lint (0 issues), go test ./internal/... green.
• Reviewed per task and as a whole branch; one final-review round fixed the changelog wording and added the acceptance test, one live-run round dropped an ImportStatePersist that made Terraform refuse the import ("Resource already managed").

Follow-up, not in this PR: Update carries its own copy of assignBody's body-building because assignBody takes a *resource.CreateResponse; changing it to take *diag.Diagnostics would let both paths share one function.