fix: preserve empty list vs null distinction for optional list attributes

The API returns null for empty arrays, but OpenTofu requires that the
state match the plan exactly — an empty list [] in the plan must remain
[] in the state, not become null. This caused "inconsistent result after
apply" errors on every resource with empty optional list fields like
mutable_patterns and ban_tags.

internal/provider/helpers_test.go

@@ -63,8 +63,11 @@ func TestListToStrings_WithValues(t *testing.T) {
 func TestStringsToList_EmptySlice(t *testing.T) {
 	ctx := context.Background()
 	result := stringsToList(ctx, []string{})
-	if !result.IsNull() {
-		t.Fatalf("expected null list for empty slice, got %v", result)
+	if result.IsNull() {
+		t.Fatalf("expected empty list for empty slice, got null")
+	}
+	if len(result.Elements()) != 0 {
+		t.Fatalf("expected 0 elements, got %d", len(result.Elements()))
 	}
 }
 
@@ -103,3 +106,42 @@ func TestStringsToList_SingleValue(t *testing.T) {
 		t.Fatalf("expected [\"solo\"], got %v", back)
 	}
 }
+
+func TestPreserveListNullEmptySemantics(t *testing.T) {
+	ctx := context.Background()
+	emptyList, _ := types.ListValueFrom(ctx, types.StringType, []types.String{})
+	nullList := types.ListNull(types.StringType)
+	populatedList := stringsToList(ctx, []string{"a"})
+
+	t.Run("prior empty + current null → preserves empty", func(t *testing.T) {
+		result := preserveListNullEmptySemantics(emptyList, nullList)
+		if result.IsNull() {
+			t.Fatal("expected empty list, got null")
+		}
+		if len(result.Elements()) != 0 {
+			t.Fatalf("expected 0 elements, got %d", len(result.Elements()))
+		}
+	})
+
+	t.Run("prior null + current null → stays null", func(t *testing.T) {
+		result := preserveListNullEmptySemantics(nullList, nullList)
+		if !result.IsNull() {
+			t.Fatal("expected null, got non-null")
+		}
+	})
+
+	t.Run("prior empty + current populated → uses current", func(t *testing.T) {
+		result := preserveListNullEmptySemantics(emptyList, populatedList)
+		elems := listToStrings(ctx, result)
+		if len(elems) != 1 || elems[0] != "a" {
+			t.Fatalf("expected [a], got %v", elems)
+		}
+	})
+
+	t.Run("prior populated + current null → stays null", func(t *testing.T) {
+		result := preserveListNullEmptySemantics(populatedList, nullList)
+		if !result.IsNull() {
+			t.Fatal("expected null (prior was populated, not empty — no preservation)")
+		}
+	})
+}