Description

Adds a Terraform credentials helper for Cloudsmith registries so
terraform init can authenticate against a Cloudsmith Terraform registry with
no token on disk, reusing the existing Cloudsmith CLI credential chain
(--api-key/CLOUDSMITH_API_KEY, credentials.ini, the OS keyring, or OIDC).

Terraform discovers credentials helpers as executables named
terraform-credentials-<name> and only searches its plugin directories (never
$PATH). This PR ships the helper, a launcher/wrapper that satisfies that
discovery contract, an installer that wires up ~/.terraformrc, and the
repository-scoped token format the registry expects.

What's included

Command (cloudsmith credential-helper terraform)

• Implements Terraform's credentials-helper protocol for the get verb.
  Accepts Terraform's [verb] <hostname> calling convention (verb defaults to
  get; hostname falls back to stdin) so the launcher can forward args
  verbatim.
• Returns {"token": "..."} for a Cloudsmith host and {} for any other host
  (exit 0) so Terraform falls back to its own credential sources.
  store/forget and unknown verbs return an actionable error and a non-zero
  exit. Missing credentials for a Cloudsmith host produce a clean refusal, never
  a traceback.
• Registered on the credential-helper group.

Installer (credential-helper install/uninstall/list terraform)

• Writes the launcher into Terraform's plugin dir (~/.terraform.d/plugins by
  default; --bin-dir overrides) and manages the credentials_helper "cloudsmith" block in ~/.terraformrc via a regex block editor (no HCL
  parser); refuses if a different helper block already exists.
• Bakes the resolved --org, -P/--profile, and --repo into the terraformrc
  args list so terraform init needs no environment variables. Computes the
  terraformrc change before writing the launcher so a conflict leaves no orphan.

Repository-scoped, custom-domain-aware token format

• Terraform never tells a credentials helper which repository is requested, so
  -r/--repo/--repository (or CLOUDSMITH_REPO) is required on get, and
  can also be passed to install to bake it into the terraformrc args.
• Tokens are scoped per repository:
  • Standard *.cloudsmith.io/*.cloudsmith.com hosts → {org}/{repo}/{token}
    (the organisation is required here).
  • Custom domains (already bound to a single organisation) → {repo}/{token}
    (the org is used only to resolve the domain, never emitted in the token).
• Added is_standard_cloudsmith_domain() to credential_helpers/common.py to
  distinguish standard hosts from custom domains (is_cloudsmith_domain was
  refactored to reuse it; behaviour unchanged).

Type of Change

• New feature

Testing

• Unit tests for the runtime (get/store/forget, token / empty-object /
  refusal outcomes, org-required-on-standard-domain, org-omitted-on-custom-
  domain), the CLI shim, the wrapper delegation, the terraformrc block
  helpers, and the installer (launcher + terraformrc, --org/-P/--repo
  baking, conflict handling).
• is_standard_cloudsmith_domain unit coverage (apex/subdomain/scheme/casing
  matches, plus custom-domain and lookalike non-matches).
• A live integration test (@pytest.mark.integration) that runs a real
  terraform init in an isolated HOME and asserts it does not fail for
  authentication reasons; skips cleanly when terraform, the wrapper, or the
  PYTEST_CLOUDSMITH_* vars are absent.

env -u CLOUDSMITH_PROFILE -u CLOUDSMITH_ORG -u CLOUDSMITH_WORKSPACE \
    -u CLOUDSMITH_KEYRING_BACKEND HOME=$(mktemp -d) \
    pytest -m "not integration"

Additional Notes

• Auth with a JWT is dependent on https://github.com/cloudsmith-io/cloudsmith/pull/16538 being merged and released
  terraformrc block management, the required repo flag, and the token format).