feat: provider audit — builder support, function tuning, source archive

Аудит провайдера vs каноничный Fission. Добавлено:

Environment:
- builder_image, builder_command для Go и языков с build step

Package:
- deploy_type (literal/source) для переключения deployment/source archive
- loadPackageSourceArchive() — zip-упаковка source_dir
- Убран пустой source:{} из literal mode

Function:
- executor_type (poolmgr/newdeploy/container)
- function_timeout, idle_timeout
- min_scale, max_scale для ExecutionStrategy

Все 21 тест пройден. Обратная совместимость проверена.
Документация: doc/AUDIT_PROVIDER_VS_FISSION_2026-06-03.md

terraform/provider/internal/resources/package_resource_test.go

@@ -1,6 +1,8 @@
 package resources
 
 import (
+	"archive/zip"
+	"bytes"
 	"context"
 	"crypto/sha256"
 	"encoding/base64"
@@ -104,6 +106,47 @@ func TestPackageToUnstructured(t *testing.T) {
 	if string(decoded) != "print('hi')" {
 		t.Fatalf("unexpected decoded literal: %q", string(decoded))
 	}
+
+	// Verify no empty source map is generated
+	_, sourceFound, _ := unstructured.NestedMap(obj.Object, "spec", "source")
+	if sourceFound {
+		t.Fatalf("empty source should not be present in deployment mode")
+	}
+}
+
+func TestPackageToUnstructuredSourceMode(t *testing.T) {
+	input := packageResourceModel{
+		Name:        types.StringValue("pkg-go"),
+		Environment: types.StringValue("go-env"),
+		DeployType:  types.StringValue("source"),
+		BuildCmd:    types.StringValue("build"),
+	}
+
+	obj := packageToUnstructured(input, "default", []byte("zip-content"))
+	sourceLiteral, found, err := unstructured.NestedString(obj.Object, "spec", "source", "literal")
+	if err != nil || !found {
+		t.Fatalf("source.literal not found")
+	}
+
+	decoded, err := base64.StdEncoding.DecodeString(sourceLiteral)
+	if err != nil {
+		t.Fatalf("decode source literal: %v", err)
+	}
+	if string(decoded) != "zip-content" {
+		t.Fatalf("unexpected source literal: %q", string(decoded))
+	}
+
+	// Verify no deployment section in source mode
+	_, deployFound, _ := unstructured.NestedMap(obj.Object, "spec", "deployment")
+	if deployFound {
+		t.Fatalf("deployment should not be present in source mode")
+	}
+
+	// Verify buildcmd is set
+	buildCmd, _, _ := unstructured.NestedString(obj.Object, "spec", "buildcmd")
+	if buildCmd != "build" {
+		t.Fatalf("unexpected buildcmd: %q", buildCmd)
+	}
 }
 
 func TestResolveNamespace(t *testing.T) {
@@ -179,3 +222,39 @@ func TestHTTPTriggerRoundTrip(t *testing.T) {
 		t.Fatalf("unexpected url: %q", state.URL.ValueString())
 	}
 }
+
+func TestLoadPackageSourceArchive(t *testing.T) {
+	tempDir := t.TempDir()
+	// Create multiple files to zip
+	files := map[string]string{
+		"main.go": "package main\n\nimport \"net/http\"\n\nfunc Handler(w http.ResponseWriter, r *http.Request) {}\n",
+		"go.mod":  "module example.com/fn\n\ngo 1.21\n",
+	}
+	for name, content := range files {
+		if err := os.WriteFile(filepath.Join(tempDir, name), []byte(content), 0o600); err != nil {
+			t.Fatalf("write %s: %v", name, err)
+		}
+	}
+
+	zipBytes, err := loadPackageSourceArchive(tempDir)
+	if err != nil {
+		t.Fatalf("loadPackageSourceArchive error: %v", err)
+	}
+
+	// Verify it's a valid zip
+	reader, err := zip.NewReader(bytes.NewReader(zipBytes), int64(len(zipBytes)))
+	if err != nil {
+		t.Fatalf("invalid zip: %v", err)
+	}
+
+	foundFiles := map[string]bool{}
+	for _, f := range reader.File {
+		foundFiles[f.Name] = true
+	}
+	if !foundFiles["main.go"] {
+		t.Fatalf("main.go not found in zip")
+	}
+	if !foundFiles["go.mod"] {
+		t.Fatalf("go.mod not found in zip")
+	}
+}