feat(gcp): add Compute PacketMirroring

[naxty]

Adds GCP::Compute::PacketMirroring: a copy of selected VMs' traffic, delivered to an internal passthrough load balancer for inspection. mirroredResources says whose packets to copy — named instances, whole subnets, or network tags — and collectorIlb says where the copies go. The collector must be a forwarding rule created with isMirroringCollector; an ordinary internal rule is refused.

Conformance has NOT been run

No make install and no make conformance-* target was run in this worktree, because make install does rm -rf $HOME/.pel/formae/plugins/gcp — a shared path other agents are using. The packet-mirroring and packet-mirroring-update cases have never executed. Everything below was established by probing the live API directly with curl against development-477117, not by running the harness.

What the probe established

Created and deleted, in europe-central2, against the real API:

step	result
packetMirrorings.list	200
insert	works; prerequisite chain is network → subnet → regionHealthCheck → regionBackendService → forwardingRule(isMirroringCollector)
get	works
patch	works for description, priority, enable, filter, mirroredResources
delete	works

Every probe resource, including the network and subnet, was deleted and the deletion verified by listing.

Cost: none. Mirroring a subnet rather than named instances means no VM has to exist to have something to mirror, and the collector's backend service carries no backends. Packet mirroring bills on mirrored traffic, and nothing is mirroring.

Two API behaviours the type compensates for

network cannot be patched. It is fixed once set, and the API answers Invalid value for field 'resource.network.url': ... Network cannot be changed to a patch carrying it in any spelling other than the exact stored URL. A forma names a network by self link, short path or bare name interchangeably, so leaving the field in an update body would make whether the update works depend on how the reference happened to be written. It is createOnly, so it is dropped from update bodies entirely and a change to it replaces the resource.

patch is a JSON merge patch. A selector left out of mirroredResources keeps its old value rather than being cleared — verified directly: patching {"mirroredResources":{"tags":["t"]}} left the existing subnetworks in place, and a subsequent patch omitting tags did not remove the tag. A forma dropping every tag would therefore leave the tags mirroring while the plugin reported the update as applied — a change that silently does not happen. An explicit empty list does clear a selector (also verified), so the absent selectors are filled with empty lists on update. Lists that are present replace rather than merge, so nothing else needed changing.

The -update.pkl case drops a tag the create declared, so this is exercised rather than asserted — if the transformer regresses, the update verify fails.

Read-back mismatches handled

• Every reference in this resource is an object ({url: ...}) rather than a bare string, and GCP answers each with a second canonicalUrl naming the same target by numeric id. Output-only, but it sits inside a sub-resource, so it is stripped in the response transformer — otherwise every read disagrees with the declaration and plans an update that changes nothing.
• region comes back as a full URL and is reduced to its last segment, as for every other regional compute type.
• A url sent as a short projects/… path reads back as a full https://www.googleapis.com/compute/v1/… URL. The fixture passes res.selfLink throughout, which is already the full form, so the two agree.
• priority is a plain JSON number, not a stringified int64 — no Int/string mismatch here.
• Server defaults observed on a minimal insert: priority → 1000, enable → "TRUE", filter → {"direction":"BOTH"}. All three carry hasProviderDefault with pending rows in schema/provider-default-dispositions.json.

Two types dropped from the batch

firewallPolicies — already implemented. It ships as GCP::Compute::NetworkFirewallPolicy and GCP::Compute::RegionNetworkFirewallPolicy (schema/pkl/compute/networkFirewallPolicy.pkl, regionNetworkFirewallPolicy.pkl), both already using the firewallPolicies URL segment. Adding it would have been a duplicate resource type and make verify-schema would have failed.

networkEdgeSecurityServices — not creatable in this project, and billable if it were. insert with validateOnly=true (so nothing was created and nothing charged) answers:

Network Security Policies require Cloud Armor Managed Protection Plus tier and above to use.

and the CLOUD_ARMOR_NETWORK security policy it exists to attach answers the same. That tier is a paid Cloud Armor Enterprise subscription. Two further notes for whoever picks this up: the type has no per-region list method at all — only aggregatedList (which does work, returning nothing) — so discovery would need a different shape from every other regional compute type; and enabling it turns on advanced network DDoS protection, which is what the subscription bills for.

Gates

All run and passing in this worktree:

• go build ./...
• golangci-lint run ./...
• make test-unit (7 new //go:build unit tests for the transformers)
• make verify-schema (200 resource types, 0 duplicates; parity check ok)
• pkl eval formae-plugin.pkl --format json
• bash -n over every tracked *.sh
• make lint-reuse
• Both new fixtures evaluated with pkl eval against the local schema, and the rendered JSON checked: the resolvable references land correctly at all three nesting depths, including mirroredResources.subnetworks[].url two levels down.

Not verified

• The conformance harness itself — create, update, replace, discovery, out-of-band delete. See above.
• No -replace.pkl: the type has mutable fields, so -update.pkl is the right case per the deliverable spec. A replace case would exercise the immutable name, but writing one that has never been run seemed worse than not having one.
• Whether collectorIlb can be repointed at a different forwarding rule. A patch carrying the same collector is accepted; changing it to another rule would have meant standing up a second ILB, which the probe did not do. The field is registered as mutable on the strength of the API reference; if it turns out to be fixed, it needs createOnly.