chore(exoscale): the provider constraint becomes an exact pin, and the safety floor stops depending on a registry's clock

[stephrobert]

examples/stacks/exoscale asked for >= 0.71.0. The floor was right; writing
it as a lower bound was the accident.

What a lower bound actually resolved to

registry.terraform.io and registry.opentofu.org do not index together, and
this repository drives both engines over the same stack. Measured
2026-09-14:

engine	stable versions listed	>= 0.71.0 resolved to
terraform	85	0.72.0
opentofu	84	0.71.0

Two engines driving one stack with two different providers, both reporting that
it passed. docs/clients.md already says a constraint's resolved version "is
not knowable here"; this is a step past that — it was not the same on the two
legs.

Why it matters more here than elsewhere

terraformProviderFloor is v0.71.0 because below it the provider honours
EXOSCALE_API_ENDPOINT for only half its calls and the rest reach a paying
account — 57 requests, measured in #525.

While the window was open, the opentofu leg sat exactly on that floor. Not
below it, and guardSplitClients would refuse a client that were. But the
margin was zero, held there by an indexing schedule rather than by anything in
this repository. That guard is the right last line; it should not be the first.

The window closed on its own about forty minutes later — recorded in #778 so
nobody re-measures 0.72.0 on both engines tomorrow and concludes the report was
wrong. The mechanism did not close: it reopens at every publication, and it
reopened for the Scaleway provider in the same hour.

What 0.72.0 carries

Read from the commits between the two tags rather than assumed: SKS nodepool
kubelet max-pods, a ClickHouse dbaas resource, a new zone es-mad-1, re-enabled
EIP tests. Nothing this emulator serves — which is why this is a pin move and
not a compatibility change.

Proven

• conformance:stacks: green — three stacks applied, re-planned with no
  resource change, destroyed.
• And the part a green gate does not prove. That log is filtered and never
  says who answered, so it was measured separately: init -upgrade in a copy of
  the stack installs 0.72.0 under terraform and 0.72.0 under tofu. A pass
  with a cached provider would have proved the wrong thing.
• mise run check and docs:check green. The generated row in
  docs/clients.md now reads "exact: the version that answered" instead of
  "not knowable here".

Not in this change

The Outscale stacks keep ~> 1.7. They agree across both registries today by
luck rather than by construction, and the same window opens at their next
publication — that is the general half of #778, a decision rather than an
oversight.

🤖 Generated with Claude Code