feat(tfhost): host real providers — protocol 5+6, msgpack, nested blocks

[astrojerms]

What

Closes the four gaps that blocked openctl's Terraform host (tfhost) from driving a real terraform-provider-* binary. It could previously only round-trip opaque state and send JSON config against an in-repo JSON fake.

Gap	Now
msgpack state decoding	decodeState reads a provider's DynamicValue (msgpack or JSON) via the public tfprotov6.DynamicValue.Unmarshal(type)
nested-block / typed config encoding	encodeConfig builds a tftypes.Value conforming to the schema's implied type (nested blocks included) → NewDynamicValue (msgpack)
protocol v5	negotiated alongside v6 via go-plugin VersionedPlugins; SDKv2 (proto 5) providers driven through v5adapter converting field-identical v5⇄v6 messages
real-binary e2e	drives the published hashicorp/time provider (proto 5) end-to-end, plus an upgraded msgpack/nested-block tf-fake (proto 6)

How it stays correct

• Public codec, no deprecated API. The earlier slice sent JSON + stored opaque bytes specifically to avoid terraform-plugin-go's deprecated low-level helpers. The fix uses the library's intended value codec — tfprotov6.NewDynamicValue / DynamicValue.Unmarshal — the same functions provider authors use. Full msgpack fidelity, zero SA1019.
• Adapter stays on tfplugin6 types. provider.go is unchanged in shape; a protocol-5 provider is bridged at the client boundary (client_v5.go). tfplugin5 gRPC stubs vendored in pkg/tfplugin5 (mirrors pkg/tfplugin6, generated from the upstream proto).
• provider_state stays opaque — stored DynamicValue bytes round-trip untouched into Plan/Apply.

Verification

• plugins/tf-fake upgraded to a nested-block, msgpack-emitting framework provider — existing tests now exercise the real wire encoding; a new TestProviderAdapterNestedBlock proves a nested network block round-trips through the adapter.
• TestRealProviderTimeStatic (gated on TFHOST_E2E_PROVIDER_TIME) drives the real hashicorp/time v0.12.1 binary: create/read/delete time_static, decoding computed msgpack outputs (year=2020, unix, id). Verified locally:

  TFHOST_E2E_PROVIDER_TIME=/path/to/terraform-provider-time go test ./internal/controller/providers/tfhost/ -run TestRealProviderTimeStatic
  

• Tests assert the negotiated protocol (fake→6, time→5).

Local CI

gofmt / go vet / staticcheck / golangci-lint / modernize (generated-filtered) / go test ./... / go test -race (tfhost) all green. No new external deps (uses already-present terraform-plugin-go).

Follow-ups

UpgradeResourceState wiring; making the real-provider e2e run in CI (currently gated/local); then wire a real provider (e.g. the Terraform Cloudflare provider) through config.