feat!: replace docker artifact packager with cruxstack/buildkit provider

[sgtoj]

Summary

Replaces the bot_artifact module (github.com/cruxstack/terraform-docker-artifact-packager) with the cruxstack/buildkit Terraform provider. The Lambda deployment package is now built from the Dockerfile via BuildKit's gRPC API instead of driving the Docker CLI/daemon through a module.

Warning

This is a major version bump when merged to main. Do not merge until the release is planned.

Changes

• Add the cruxstack/buildkit provider to required_providers (>= 0.0.1).
• Replace module.bot_artifact with a buildkit_artifact resource plus a buildkit_context data source. The context digest is wired into the resource triggers so rebuilds happen on content change; bot_force_rebuild_id remains supported as an additional trigger.
• Point the Lambda at buildkit_artifact.bot.artifact_path and restore source_code_hash via buildkit_artifact.bot.artifact_sha256.
• Preserve build args (BOT_VERSION, BOT_REPO), build target (package), and the source path (/tmp/package.zip) so the produced package is equivalent.
• Gitignore .terraform.lock.hcl (root and nested) since this is a reusable module and consumers generate their own lock files.
• Update README prerequisites/build description to reference BuildKit and the provider's endpoint discovery; correct bot_force_rebuild_id type to string.

State migration (no manual state rm)

Existing deployments had module.bot_artifact in state, backed by providers this module no longer uses (kreuzwerker/docker, hashicorp/archive, hashicorp/null, hashicorp/random). Without handling, removing the module from config makes Terraform/OpenTofu try to destroy those orphaned resources and fail because their providers are no longer configured — requiring a manual terraform state rm module.bot_artifact.

This PR migrates automatically:

• Adds a removed block for module.bot_artifact with lifecycle { destroy = false }, so the next plan/apply forgets the old module from state without destroying anything.
• Bumps required_version to >= 1.7 (minimum for removed blocks; works on both Terraform and OpenTofu 1.7+).
• Temporarily re-declares the docker/archive/null/random providers so init succeeds for upgrading users whose state still references them.

The removed block and the legacy provider declarations are transitional and should be dropped in a follow-up release once consumers have upgraded.

Breaking changes

• Now requires the cruxstack/buildkit provider and a reachable BuildKit endpoint instead of the terraform-docker-artifact-packager module.
• Now requires Terraform/OpenTofu >= 1.7 (previously >= 1.3).
• Consumers must run terraform init / tofu init to install the new provider.
• A BuildKit endpoint must be available: auto-discovered from Docker Desktop / OrbStack / Colima, via BUILDKIT_HOST, or an embedded rootless buildkitd on Linux.
• The artifact is now written to a fixed path (dist/package.zip) rather than a hashed filename.

Validation

• terraform fmt -check on .tf files — clean
• terraform init -backend=false + terraform validate — success (provider cruxstack/buildkit v0.0.1 installs and config validates)

Notes

• The provider's README advertises ~> 1.0, but only v0.0.1 is currently published to the registry; the constraint is pinned to >= 0.0.1 accordingly. Bump to ~> 1.0 once a 1.x release is available.