fix(terraform): defer dynamic block expansion when for_each contains unknown values

[blinkagent]

Problem

Dynamic blocks with for_each referencing nested local values fail to expand correctly. When a local value references another local (e.g., local.ides contains local.vscode_name), the for_each value may be partially resolved on the first evaluation pass, containing cty.DynamicVal for the unresolved references.

The existing IsKnown() check only verifies the top-level value (a tuple/list), which appears "known" even when its nested elements contain DynamicVal. The dynamic block then expands with stale data and gets marked as expanded, preventing re-expansion on subsequent iterations when the context is fully resolved.

Reproduction

locals {
  vscode_name = "VSCode"
  ides = [{ name = local.vscode_name, value = "vscode" }]
}

data "coder_parameter" "ide_picker" {
  name    = "ide_picker"
  type    = "string"
  default = "vscode"
  dynamic "option" {
    for_each = local.ides
    content {
      name  = option.value.name   # evaluates to DynamicVal instead of "VSCode"
      value = option.value.value
    }
  }
}

Fix

Change the guard check in expandDynamic() from IsKnown() to IsWhollyKnown(), and return nil, nil (defer) instead of an error.

• IsWhollyKnown() recursively checks all nested elements, catching DynamicVal inside tuples/objects
• Returning nil, nil defers expansion without marking the block as expanded
• On the next evaluation iteration, the locals are fully resolved and expansion succeeds

Testing

• Verified with a test case in coder/preview that the nested local for_each now correctly resolves
• All existing pkg/iac/terraform/... tests pass
• All existing coder/preview non-E2E tests pass

Fixes coder/coder#20930

[Emyrk]

Fixed #37