IGA-4180: add Terraform access profile types in v1.6.0

[alextebbs]

Summary

• prepare provider v1.6.0 from the current C1 OpenAPI contract
• expose conductorone_access_profile.type as optional and computed
• send configured type only on Create, refresh it from Read/import, and force replacement when configured type changes
• preserve legacy omitted-type plans and document Requestable, Birthright, and Blended capabilities
• add acceptance coverage for valid types, imports, replacement, invalid settings, visibility bindings, automations, and corrective disables
• preserve the v1.5.0 access_review_template.recurrence_rule.frequency omission contract through a durable overlay, preventing an unrelated upgrade-time validation failure
• remove the obsolete app-entitlement count patch; its target is hand-maintained via .genignore, and exact make gen now completes

Test plan

• authenticated make gen for v1.6.0 with pinned Speakeasy 1.762.0: https://github.com/ConductorOne/terraform-provider-conductorone/actions/runs/33457717916
• GOTOOLCHAIN=go1.25.8 make pre-commit with golangci-lint 2.11.4 (build, 0 lint issues, unit suite, docs generation, pagination check)
• make validate-docs
• make check && make verify-pagination (make check retained the existing 46 unregistered-constructor warnings)
• TestAccessReviewTemplateRecurrenceFrequencyRemainsOptional proves frequency remains Optional+Computed without the NotNull validator
• local Terraform 1.10.5 plan -refresh=false -detailed-exitcode against legacy access-profile state with omitted type and stored Blended type: no changes
• complete focused TF_ACC=1 matrix against the local c1dev Squire Envoy endpoint with ACCESS_PROFILE_TYPES temporarily enabled: all 10 leaf cases passed
• cleanup verified: no terraform-access-profile-type-* profiles or fixture apps remain; ACCESS_PROFILE_TYPES restored to its original disabled/unbound state
• generic provider CI keeps the explicit CONDUCTORONE_ACCESS_PROFILE_TYPES_ENABLED=1 guard so a tenant feature-gate error cannot masquerade as a capability diagnostic

Release Notes

Provider v1.6.0 adds create-time selection of Requestable, Birthright, or Blended type on conductorone_access_profile. Existing configurations that omit type remain Blended and plan without replacement.

[linear-code]

IGA-4180

[highb]

There's an unrelated change to recurrence_rule.frequency that will break on customer upgrades because it now enforces not null. ☹️

🤖 details

                                                                                                           
 The PR adds speakeasy_stringvalidators.NotNull() to access_review_template.recurrence_rule.frequency — an 
 attribute that was previously Optional + Computed. Proven live:                                           
                                                                                                           
 ┌─────────────────────────────┬─────────────────────────────────┬───────────────────────────────────────┐ 
 │ Test                        │ Baseline (v1.5.0)               │ PR (v1.5.1)                           │ 
 ├─────────────────────────────┼─────────────────────────────────┼───────────────────────────────────────┤ 
 │ recurrence_rule present,    │ ✅ plans; apply succeeds; API   │ ❌ hard error:                        │
 │ frequency omitted → plan    │ stores FREQUENCY_UNSPECIFIED    │ recurrence_rule.frequency: value must │
 │                             │                                 │ be configured                         │
 ├─────────────────────────────┼─────────────────────────────────┼───────────────────────────────────────┤
 │ Same config + existing      │ ✅                              │ ❌ same hard error — plan/apply fails │
 │ state (created by baseline) │                                 │ on state refresh                      │
 │ → plan                      │                                 │                                       │
 └─────────────────────────────┴─────────────────────────────────┴───────────────────────────────────────┘

 This is the exact shape a customer who set recurrence_rule = { interval = 1, start_date = ... } has on
 disk today. Their first terraform plan after upgrading errors out, and there is no path to a clean plan
 except editing their config to add frequency = "FREQUENCY_NONE" (a semantic change: it alters
 is_campaign_schedule_enabled behavior) or removing recurrence_rule entirely. Since terraform plan fails,
 even users who don't manage ARTs in this root module but share the provider can be wedged.

 Why it happened: the SDK regeneration changed shared.RecurrenceRule.Frequency from *Frequency to
 non-pointer Frequency (OpenAPI now marks it required), and the generator emitted the matching NotNull
 validator. The PR description only mentions the access-profile type work — this validator change is
 undocumented.

 Fix options (author's call): (a) drop the NotNull validator and keep frequency Optional + Computed,
 sending the zero value only when the block is present but frequency is omitted (baseline-compatible,
 matches API which accepts omission); or (b) keep it and cut a major version + changelog callout — but
 that contradicts this PR's 1.5.1 semver bump.```

[alextebbs]

Addressed the recurrence_rule.frequency upgrade blocker.

• Added an overlay that removes frequency from the OpenAPI required list before Speakeasy generation.
• Regenerated shared.RecurrenceRule.Frequency as *Frequency with omitempty.
• Removed the generated Terraform NotNull validator while retaining Optional + Computed.
• Added TestAccessReviewTemplateRecurrenceFrequencyRemainsOptional as a regeneration tripwire.
• Pinned the regenerated provider release at v1.5.1; this remains backward-compatible rather than becoming a major-version break.

Verification: pinned Speakeasy generation passed, the focused recurrence test passed, and full make pre-commit plus make validate-docs passed with 0 lint issues.

This comment was written by openai/gpt-5.6-sol, not a human.

[alextebbs]

Updated the release from v1.5.1 to v1.6.0. Adding the optional conductorone_access_profile.type configuration surface is backward-compatible new functionality, so a minor SemVer bump is the correct classification.

The pinned Speakeasy regeneration now emits v1.6.0 consistently in gen.yaml, .speakeasy/gen.lock, the SDK user agent, provider example, README install snippet, and generated docs. Full pre-commit and docs validation pass.

This comment was written by openai/gpt-5.6-sol, not a human.

[github-actions]

✅ SDK Test Report: conductorone-terraform — tests passed   View Report