[jmfiola]

Summary

When a sensor has both Fleet pairing and deployment metadata, cloud-init deployed the sensor already paired and then applied the metadata with corelightctl sensor configuration put. A Fleet-managed sensor rejects direct configuration (422 ... managed by Fleet Manager), so the metadata was never applied and the Terraform module/version fields stayed empty.

This change applies pairing only after the metadata:

1. corelightctl.yaml is written without sensor.pairing. The pairing settings are staged in /etc/corelight/fleet-pairing.yaml (mode 0600).
2. corelightctl sensor deploy runs with the sensor unpaired.
3. The deployment metadata is applied with configuration put (still best-effort).
4. The staged pairing is installed as the drop-in /etc/corelight/corelightctl.yaml.d/01-fleet.yaml, and corelightctl sensor deploy runs again to pair with Fleet.

Without deployment metadata, the generated cloud-init is unchanged: pairing stays in corelightctl.yaml and the sensor deploys once.

Testing

• tests/paired_metadata.tftest.hcl now asserts that pairing is absent from corelightctl.yaml, that the staged 0600 drop-in has the full pairing, and the deploy → metadata → drop-in → deploy order. A new case keeps inline pairing without metadata. The updated test fails against the previous template.
• modules/_shared/config/sensor: 16 passed, 0 failed. just test-unit: no failures.
• just fmt-check and tflint --recursive pass. just docs-check fails only on modules/_shared/config/fleet/README.md, which also fails on main and is untouched here.
• Manually ran the same sequence on a deployed 29.3 software sensor paired with Fleet: the metadata configuration put succeeded, the sensor re-paired after the second deploy, and Fleet reported deployment_metadata.terraform_module.

Note: sensors with both pairing and metadata now run corelightctl sensor deploy twice; the second run took about a minute in testing.