Kubernetes: model the new talos.imageFactoryCA field (upstream cozystack#3797) #31

Context

cozystack/cozystack PR #3797 adds a new optional field to the Kubernetes app's Talos block:

It carries the CA, in PEM form, that CDI must trust when it imports the worker OS disk image over HTTPS. Without it a Kubernetes release pointing talos.imageFactoryURL at a self-hosted Image Factory served by an internal CA fails the import with x509: certificate signed by unknown authority, and workers never leave Provisioning. Upstream issue: cozystack#3796.

Why this repository is affected

Per the upstream trigger map (docs/agents/contributing.md, "Downstream Repositories"), this provider is hand-written: every Kind carries a hand-maintained Terraform schema with its own expand/flatten pair, with no codegen from values.schema.json. The entry that applies is "Add, remove or rename a field in an app's values.schema.json → the schema, the model, and the expand/flatten pair."

k8sTalosResourceAttribute in internal/provider/kubernetes_schema.go models the Talos block attribute by attribute — image_factory_url, installer_repository, schematic_id, version — so a cluster written through Terraform silently loses the new field until it is added there. The failure mode is the awkward one: image_factory_url is settable today, so a user can point Terraform at an internal factory and get exactly the broken import the upstream field exists to fix, with no way to express the fix.

What is needed

• An image_factory_ca string attribute on the Talos block in kubernetes_schema.go, Optional only — matching the sibling attributes, which are left unset to follow the platform default rather than restated with a stringdefault.
• The matching Computed: true attribute on the data source in k8sTalosDataSourceAttribute.
• The model field and both directions of the expand/flatten pair in kubernetes_model.go.
• Coverage in kubernetes_model_test.go alongside the existing Talos fields.

One caveat worth carrying over

The value is a certificate, not a secret, but it is long and multi-line. Terraform users will normally supply it with file("ca.pem") rather than a heredoc; the upstream chart accepts one or more complete PEM certificate blocks and rejects anything else — including a bundle that also carries a private key — so a value that fails those guards surfaces as a Helm render error on apply rather than as a plan-time validation failure here.

Filed as an issue rather than a PR per the upstream contributing guide, matching the shape of #19, #20 and #26.