feat: add provider-ephemeral-resources skill

[AdamTylerLynch]

Adds a provider-ephemeral-resources skill, closing the "add docs on writing ephemeral resources" gap raised in the #14 discussion. The plugin covered testing ephemeral resources (provider-test-patterns/references/ephemeral.md) and their docs paths (provider-docs), but nothing covered implementing them.

What it teaches

• When an ephemeral resource is the right shape (vs a data source, vs a regular resource + write-only attributes), and where ephemeral values may flow (provider config, write-only attributes, provisioners)
• The Open/Renew/Close lifecycle with a complete worked example (token lease): resp.Result, RenewAt with a safety margin, lease handles passed via Private between lifecycle calls
• Registration via provider.ProviderWithEphemeralResources and resp.EphemeralResourceData
• Design rules: never log the value or put it in diagnostics; Sensitive: true; no plan modifiers/import/id (there is no state); skip Close rather than shipping a no-op that implies revocation
• Testing (echo-provider pattern, Terraform >= 1.10 version gating) and documentation delegated to the sibling skills that own them

Structure mirrors the AWS provider's add-a-new-ephemeral-resource contributor guide (minimum test coverage: basic + per-attribute) translated to generic Plugin Framework code.

Addresses the ephemeral-resources request in #14.

Verification: scripts/validate-structure.sh passes; registers the skill in terraform/README.md, AGENTS.md, CHANGELOG.md (expect trivial adjacent-line conflicts with sibling registration PRs).